finished up the xsrf protection