updated to allow POST