add hits view
add csrf protect to hits