re-enable CSRF