changed routing, implemented csrf protection, json request/response, views moved to admin folder