url tag and csrf and learn to read source code