support CSRF protection
add "action" to DSL, which creates buttons in UI