fixed csrf and added flash messages