changed form field names and added csrf protection