csrf
edit permission
use fetchmeta
tidy