rm csrf from api