fix check_xsrf in all handlers redirection bug