removed CSRF token code AGAIN