few errors

csrf bug still there