added csrf protection for submission and bad exits no longer redirect to home