add client side csrf handling
use a slug as brainstorming primary key