added xss and csrf