updated javascript and fixed csrf