use relative redirects
don't enforce locales
add csrf