adds authentication and csrf protection