delete csrf part of session-management's reference #134

delete csrf part of session-management's reference #134