initial code for #49, need to generate or bypass csrf token somehow to make it work