removed csrf exemption
restructured string literal for VCF header