small cleanup
let's not bother with caching since it uses csrf()