small routes and controller cleanup, csrf token