added timezone, hits default to 1, no CSRF