Add CSRF protection filter to all POST routes. clean up routes file; Use auth filter instead of controller logic; Rename login GET route to loginForm.