styling
commenting
moved csrf checks to http class