added csrf protection for csv downloads