added HTTP methods to the router; temporarily removed CSRF