fix for  CSRF detected from facebook