add xsrf protection to host page
fix bug in status control visuals