disable csrf protection for upgrade (may not have right keyring yet)