login added, very rough
csrf protection added, minor tweaks to models