fix awkward assert message
temporary hack for our CSRF