Hi @micoHuang,
I’m sorry to see no one has any suggestions for you. I don’t have a solution, but I wanted to be sure you had seen this topic: Troubleshooting "BAD CSRF" error on initial site setup?.
It’s not identical to your situation, but there may be something there that gives you some help.
The topic I linked above has a reply that describes how to enable force https… I’m wondering if using those instructions with false instead of true might allow you to disable it? (Note: Please wait to see if anyone chimes in before you try that. 
)