add csrf protection work around and begin wk w strng params