skip stupid CSRF thing
standard users can view responses