add csrf filters to controllers
slightly tweak style
protect admin panel with filter
finish shopping cart