status class
new action handling, extract csrf, use new status class