Play: working application (w/o CSRF protection & incorrect use of http methods)