currently does not work due to CSRF, but should work when we figure out how to let plugins bypass csrf when talking to zoraxy