fixed CSRF and edited UI