all views now under CSRF protection