improve fileadmin flexibility by moving forms into functions, fix CSRF, and fix error messages on validation failure