fix /create/ url route
csrf token stuff