add proxy true for session and remove csrf token