shouldn't this (and the corresponding view) be a POST?