add command without csrf