csrf exempt functionality, flash messages, proper user session handling