auth csrf works create bands/controllers