fixed csrf bug on rest api