fixed #2.  adding csrf protection too