Fix csrf issues, add tests