fixed csrf finally. small changes to ugly templates