added csrf-Protection and re-enabled user priviledges check