use session/token for csrf attack.
shorten some code; get $Cena using argument.