fixed typo and handled CSRF