Add csrf protection, more clean-up, ...