using null_session for CSRF protection to ease BAckbone usage
new factoid form correctly renders and kinda does things