fix csrf and privilege escalation bugs