proper implementation of xsrf for posts; better handling of file downloads