minor cleanup; csrf testing