add better error handling + csrf token