fix not sending csrf on POST request