xsrf partly, needs more love
cleanup