payment model PDO switch and CSRF fix