diff --git a/contrib/static/site.css b/contrib/static/site.css
index cd812e3..b300530 100644
--- a/contrib/static/site.css
+++ b/contrib/static/site.css
@@ -234,10 +234,6 @@ a, a:visited {
     margin-top: 1em;
 }
 
-#board_graph {
-    margin-top: 5em;
-}
-
 .navLinks {
      padding-bottom: 50px;
 }
diff --git a/contrib/templates/default/frontpage.mustache b/contrib/templates/default/frontpage.mustache
index bc6b27b..b7c4f85 100644
--- a/contrib/templates/default/frontpage.mustache
+++ b/contrib/templates/default/frontpage.mustache
@@ -1,9 +1,9 @@
 {{!
   frontpage.mustache -- template for index.html
   template parameters:
-  - boardgraph ( a boardPageRows instance, see srnd/model.go )
-  - postgraph ( a postsGraph instance , see srnd/model.go )
-  - overview ( an overviewModel instance, see srnd/model.go )
+  - boardgraph ( markup of boardPageRows instance, see srnd/model.go )
+  - postgraph ( markup of postsGraph instance , see srnd/model.go )
+  - overview ( markup of overviewModel instance , see srnd/model.go )
   - totalposts ( the number of total posts we have ever seen )
   - frontend ( the name of the frontend )
   - prefix ( the site's prefix )
@@ -36,7 +36,7 @@
           <tbody>
             <tr>
               <td class="posts_td">
-                {{{postsgraph.Render}}}
+                {{{postsgraph}}}
               </td>
               <td class="board_td">
                 {{! todo: move boardgraph into its own file like postsgraph }}
@@ -72,7 +72,7 @@
             </tr>
           </tbody>
         </table>
-        {{{overview.Render}}}        
+        {{{overview}}}        
       </div>
     </div>
     </center>
diff --git a/contrib/templates/default/modlogin.mustache b/contrib/templates/default/modlogin.mustache
index fb8e584..5f9643c 100644
--- a/contrib/templates/default/modlogin.mustache
+++ b/contrib/templates/default/modlogin.mustache
@@ -9,6 +9,7 @@
       <label for="mod_key">secret</label>
       <input type="password" id="mod_key" name="privkey" />
       <input type="submit" value="login" />
+      {{{csrfField}}}
     </form>
   </body>
 </html>
diff --git a/contrib/templates/default/postform.mustache b/contrib/templates/default/postform.mustache
index 4edf3a4..6a5370e 100644
--- a/contrib/templates/default/postform.mustache
+++ b/contrib/templates/default/postform.mustache
@@ -6,8 +6,10 @@
  - reference ( the post we are replying to, or empty string if it's an op )
  - button ( the text for the reply button )
  - files ( bool, do we allow attachments ? )
+ - csrf ( csrf token )
  }}
  <form action="{{post_url}}" enctype="multipart/form-data" name="post" method="post">
+ {{{csrf}}}
  <input type="hidden" name="reference" value="{{reference}}" />
  <div id="postform-outer">
    <div id="postform-inner">
diff --git a/contrib/templates/default/thread.mustache b/contrib/templates/default/thread.mustache
index 8a9234e..8bf06ad 100644
--- a/contrib/templates/default/thread.mustache
+++ b/contrib/templates/default/thread.mustache
@@ -3,7 +3,6 @@
  template parameters:
  - board ( the Board Model of the board this thread was posted in )
  - thread ( the Thread Model of the current thread being rendered )
- - form ( the post form markup )
  
  Thread Model attributes:
  - OP , the Post Model of the original poster
diff --git a/contrib/tools/api/moderate.js b/contrib/tools/api/moderate.js
new file mode 100644
index 0000000..5b7c6a0
--- /dev/null
+++ b/contrib/tools/api/moderate.js
@@ -0,0 +1,51 @@
+var http = require('http');
+
+var makeIpBans = function(cidrs, privkey, cb) {
+  cb({
+    message: cidrs.join("\noverchan-inet-ban "),
+    name: "mod#"+privkey,
+    frontend: "memegod.censor",
+    newsgroup: "ctl"
+  })
+}
+
+var makeDeletePosts = function(msgids, privkey, cb) {
+  cb({
+    message: msgids.join("\ndelete "),
+    name: "mod#"+privkey,
+    frontend: "memegod.censor",
+    newsgroup: "ctl",
+  })
+}
+
+var moderate = function(req) {
+
+  j = JSON.stringify(req);
+
+  var r = http.request({
+    port: 8800,
+    method: "POST",
+    path: "/api/post",
+    auth: "user:pass",
+    headers: {
+      "Content-Type": "text/json",
+      "Content-Length": j.length
+    }
+  }, function (res) {
+    res.on('data', function (chunk) {
+      var r = chunk.toString();
+      var rj = JSON.parse(r);
+      console.log(rj.id);
+    });
+  });
+
+  r.write(j);
+  r.end();
+}
+
+var privateKey = "longhexgoestripcodegoeshere";
+
+// ban 192.168.0.1/16 and sign with private key
+makeIpBans(["192.168.0.1/16"], privateKey, moderate);
+// delete <msg1@place.tld> and <msg2@otherplace.tld> and sign with private key
+makeDeletPosts(["<msg1@place.tld>", "<msg2@otherplace.tld>"], privateKey, moderate);