bug fix with authenticity token