csrf protected now; added trash