added audit service calls to controller methods and added _csrf token for cross site scripting protection