add receive form
protect against silly urls