added a construct function to require a csrf token