fixed csrf issues, cleaned up cruft