fixed csrf and flash messages