added csrf protection + improved tester