Models and authentication and XSRF, oh my!