csrf bug and form redesign