implemented csrf protection. better defined auth route filtering