use session/token for csrf attack.
shorten some code; get $Cena using argument.
simplify controllers code by adding helper methods.