diff --git a/cards/templates/cards/base.html b/cards/templates/cards/base.html
index a94836c..518f187 100644
--- a/cards/templates/cards/base.html
+++ b/cards/templates/cards/base.html
@@ -119,4 +119,29 @@
       }
     })();
   </script>
+  <script>
+    // Ensure HTMX requests include Django CSRF token (reads from cookie)
+    (function(){
+      function getCookie(name){
+        let cookieValue = null;
+        if (document.cookie && document.cookie !== ''){
+          const cookies = document.cookie.split(';');
+          for (let i=0;i<cookies.length;i++){
+            const cookie = cookies[i].trim();
+            if (cookie.substring(0, name.length + 1) === (name + '=')){
+              cookieValue = decodeURIComponent(cookie.substring(name.length + 1));
+              break;
+            }
+          }
+        }
+        return cookieValue;
+      }
+      document.body.addEventListener('htmx:configRequest', function(evt){
+        const csrftoken = getCookie('csrftoken');
+        if (csrftoken){
+          evt.detail.headers['X-CSRFToken'] = csrftoken;
+        }
+      });
+    })();
+  </script>
 </html>
diff --git a/db.sqlite3 b/db.sqlite3
index 22e0f36..29c9d97 100644
Binary files a/db.sqlite3 and b/db.sqlite3 differ
diff --git a/media/dinosaurs/Gallimimus.png b/media/dinosaurs/Gallimimus.png
new file mode 100644
index 0000000..2aad9a2
Binary files /dev/null and b/media/dinosaurs/Gallimimus.png differ
diff --git a/templates/cards/base.html b/templates/cards/base.html
index e61f056..6ca5306 100644
--- a/templates/cards/base.html
+++ b/templates/cards/base.html
@@ -119,4 +119,29 @@
       }
     })();
   </script>
+  <script>
+    // Ensure HTMX requests include Django CSRF token (reads from cookie)
+    (function(){
+      function getCookie(name){
+        let cookieValue = null;
+        if (document.cookie && document.cookie !== ''){
+          const cookies = document.cookie.split(';');
+          for (let i=0;i<cookies.length;i++){
+            const cookie = cookies[i].trim();
+            if (cookie.substring(0, name.length + 1) === (name + '=')){
+              cookieValue = decodeURIComponent(cookie.substring(name.length + 1));
+              break;
+            }
+          }
+        }
+        return cookieValue;
+      }
+      document.body.addEventListener('htmx:configRequest', function(evt){
+        const csrftoken = getCookie('csrftoken');
+        if (csrftoken){
+          evt.detail.headers['X-CSRFToken'] = csrftoken;
+        }
+      });
+    })();
+  </script>
 </html>