fix CSRF validation