added CSRF support to: POST /userInfo