removed csrf token protection, added demo rest actions for privilege