xss and csrf avoided, models for address, city and region added