rename "unsecured" to "open"
require CSRF token to create user