avoid CSRF validation in authentication