update index.html to try csfr attack