Made schema private, added csrf protection