added plain response to create action
removed csrf stuff