solution
CSRF not an issue