added controller methods for CSRF protection