added user creation validation, commented out csrf for now