diff --git a/rowers/templates/document_form.html b/rowers/templates/document_form.html
index 95a98a66..7e90fccc 100644
--- a/rowers/templates/document_form.html
+++ b/rowers/templates/document_form.html
@@ -5,47 +5,48 @@
 {% block title %}File loading{% endblock %}
 
 {% block meta %}
-    <script type='text/javascript'
-      src='https://ajax.googleapis.com/ajax/libs/jquery/2.1.4/jquery.min.js'>
-    </script>
-    <script type='text/javascript'
-            src='http://ajax.aspnetcdn.com/ajax/jquery.validate/1.14.0/jquery.validate.min.js'>
-    </script>
-    <script>
-      $(document).ready(function() {
-      $('#id_file').on('change', function(evt) {
-      var f = this.files[0];
-      var istcx = false;
-      var isgzip = false;
-      var size1 = 10485760;
-      var size2 = 1048576;
-      if ((/\.(tcx|TCX)/i).test(f.name)) {
-        istcx = true;
-        console.log('tcx');
-        if ((/\.(gz|GZ)/i).test(f.name)) {
-          isgzip = true;
-          console.log('gzip');
-          size1 /= 5;
-      size2 /= 5;
-      }
-      }
-      console.log(f);
-      console.log(size1)
-      console.log(size2)
-      if (f.size > size1) {
-        alert("File Size must be smaller than 10 MB");
-        this.value = null;
-      }
-      if (f.size > size2) {
-      $('#id_offline').val('True');
-      $('#id_offline').prop('checked','True');
-      console.log("Set offline to True");
-      $('#extra_message').text('Because of the large size, we recommend to use  background processing. You will receive email when it is done. The extra actions will not be performed.');
-      $('#extra_message').addClass('message');      
-      }
-      });
-      });
-    </script>
+<script type='text/javascript'
+        src='https://ajax.googleapis.com/ajax/libs/jquery/2.1.4/jquery.min.js'>
+</script>
+<script type='text/javascript'
+        src='http://ajax.aspnetcdn.com/ajax/jquery.validate/1.14.0/jquery.validate.min.js'>
+</script>
+<script>
+  $(document).ready(function() {
+  
+  $('#id_file').on('change', function(evt) {
+  var f = this.files[0];
+  var istcx = false;
+  var isgzip = false;
+  var size1 = 10485760;
+  var size2 = 1048576;
+  if ((/\.(tcx|TCX)/i).test(f.name)) {
+  istcx = true;
+  console.log('tcx');
+  if ((/\.(gz|GZ)/i).test(f.name)) {
+  isgzip = true;
+  console.log('gzip');
+  size1 /= 5;
+  size2 /= 5;
+  }
+  }
+  console.log(f);
+  console.log(size1)
+  console.log(size2)
+  if (f.size > size1) {
+  alert("File Size must be smaller than 10 MB");
+  this.value = null;
+  }
+  if (f.size > size2) {
+  $('#id_offline').val('True');
+  $('#id_offline').prop('checked','True');
+  console.log("Set offline to True");
+  $('#extra_message').text('Because of the large size, we recommend to use  background processing. You will receive email when it is done. The extra actions will not be performed.');
+  $('#extra_message').addClass('message');      
+  }
+  });
+  });
+</script>
 {% endblock %}
 
     {% block content %}
@@ -101,6 +102,20 @@
     <script src="https://ajax.googleapis.com/ajax/libs/jquery/2.1.4/jquery.min.js"></script>
 <script>   
   $(document).ready(function() {
+  var csrftoken = jQuery("[name=csrfmiddlewaretoken]").val();
+  console.log("CSRF token",csrftoken);
+  
+  function csrfSafeMethod(method) {
+  // these HTTP methods do not require CSRF protection
+  return (/^(GET|HEAD|OPTIONS|TRACE)$/.test(method));
+  }
+  $.ajaxSetup({
+  beforeSend: function(xhr, settings) {
+  if (!csrfSafeMethod(settings.type) && !this.crossDomain) {
+  xhr.setRequestHeader("X-CSRFToken", csrftoken);
+  }
+  }
+  });
   console.log("Loading dropper");
   jQuery.event.props.push('dataTransfer');
 
@@ -115,8 +130,8 @@
     console.log($(this).attr('id'),$(this).attr('name'),$(this).prop('checked'));
   } else {
     data.set($(this).attr('name'),$(this).val());
-    if ($(this).attr('id') == 'id_file') {
-      data.set("file",this.files[0]);
+      if ($(this).attr('id') == 'id_file') {
+        data.set("file",this.files[0]);
     }
     console.log($(this).attr('name'),$(this).val());
   };
@@ -167,8 +182,42 @@
   console.log("you dropped something");
   var files = e.dataTransfer.files;
   console.log(files[0]);
-  data.append("file",files[0]);
-  $("#id_file").replaceWith('<div id="id_file">'+files[0].name+'</div>');
+
+    var f = files[0];
+    var istcx = false;
+    var isgzip = false;
+    var size1 = 10485760;
+    var size2 = 1048576;
+    if ((/\.(tcx|TCX)/i).test(f.name)) {
+    istcx = true;
+    console.log('tcx');
+    if ((/\.(gz|GZ)/i).test(f.name)) {
+    isgzip = true;
+    console.log('gzip');
+    size1 /= 5;
+    size2 /= 5;
+    }
+    }
+    console.log(f);
+    console.log(size1)
+    console.log(size2)
+    if (f.size > size1) {
+    alert("File Size must be smaller than 10 MB");
+    $("#id_file").value = 0;
+    return false;
+    }
+    if (f.size > size2) {
+    $('#id_offline').val('True');
+    $('#id_offline').prop('checked','True');
+    console.log("Set offline to True");
+    $('#extra_message').text('Because of the large size, we recommend to use  background processing. You will receive email when it is done. The extra actions will not be performed.');
+    $('#extra_message').addClass('message');      
+    }
+
+
+
+    data.append("file",files[0]);
+  $("#id_file").replaceWith('<div id="id_file">'+files[0].name+'&nbsp; <a class="remove" href="javascript:void(0);"><b><font color="red">X</font></b></a></div>');
   },
   mouseenter:function(){$("#id_drop-files").css("background-color","#E9E9E4");},
   mouseleave:function(){$("#id_drop-files").css("background-color","#FFFFFF");},
@@ -176,7 +225,10 @@
   e.preventDefault();
   $("#id_drop-files").css("background-color","#E9E9E4");},
   dragleave:function(e){ e.preventDefault();},
-  });
+    });
+    $(document).on("click", "a.remove", function() {
+    $(this).parent().replaceWith('<td><input id="id_file" name="file" type="file" /></td>');
+    });
   })
 </script>
     {% endblock %}
diff --git a/rowers/views.py b/rowers/views.py
index 12eb0650..a5b0b086 100644
--- a/rowers/views.py
+++ b/rowers/views.py
@@ -8401,7 +8401,7 @@ def workout_getc2workout_view(request,c2id):
 	    return HttpResponseRedirect(url)
 
 # This is the main view for processing uploaded files
-@csrf_exempt
+#@csrf_exempt
 @login_required()
 def workout_upload_ajax(request,
                         uploadoptions={