remove balances view. add withdrawal limitations
add CSRF token checker (very simple version)