fix CSRF, fully implement create action