add csrf, conditional-get