added CSRF and form validation