added a bunch of features related to security; for example, added CSRF as well as an additional layer of authentication and permission checking on the frontend. also, largely unrelatedly, deleting stories finally works.