#17316 - remove XSRF check