fix form validation by adding csrf, move login validation back into auth class
add some sweet message flashing!