add css and fix csrf