updated to include protection against CSRF attacks