improved security against XSRF
done some refactoring