updated CSRF to not check on OPTIONS or HEAD requests