phase3 complete with csrf tokens