made the return types consistent
preparing for dependency injection
removed the CSRF protection for now