added icons
added getCategory method
check all POST-ed forms for csrf
outlined controllers, added getCreate
views for index and create