fix api to skip csfr to allow post