risk GET - still have to POST