improve browser checking, fix csrf