disable csrf protection on 404 error