fix csrf if post eq 0 and upload not checked