Rename status to root
Add require_csrf_token to all POST urls
Reorder decorators