fix buttons, finalize csrfguard