a lot of work with csrf and form passing