switch from raising an exeption if there is no CSRF, to instead clearing any setcookies
build an api for CRUD actions