notification read by
@csrf