fix errors with csrf middlewear