added csrf, broken authorization etc.