don't add csrf if no data