fixed missing csrf token, updated menu, code-formatting