https://blog.0xrobiul.me/2022/01/csrf-via-file-upload.html