csrf protection
update requirements
implement alternative is_winner
add secret key
minor clean up
set/reset experiment winners