added CSRF to the front end