tweaked routes file to only allow the minimum
uncomment protect_from_forgery because apparently that never was a problem
html heavily DRYed up, project complete?