diff --git a/plugins/fbpatch/fbpatch.php b/plugins/fbpatch/fbpatch.php
index 36fcb06..3b6d3e6 100644
--- a/plugins/fbpatch/fbpatch.php
+++ b/plugins/fbpatch/fbpatch.php
@@ -22,6 +22,7 @@ include_once(plugin_dir_path(__FILE__) . '/php/calculations.php');
 
 include_once(plugin_dir_path(__FILE__) . '/menu/admin_menu.php');
 include_once(plugin_dir_path(__FILE__) . '/menu/admin_menu_toggle.php');
+include_once(plugin_dir_path(__FILE__) . '/menu/menu_content.php');
 
 
 
diff --git a/plugins/fbpatch/html/menu.html b/plugins/fbpatch/html/menu.html
index 3270276..17a4b95 100644
--- a/plugins/fbpatch/html/menu.html
+++ b/plugins/fbpatch/html/menu.html
@@ -1,4 +1,5 @@
-<form action="<?php echo $fetch_url.'/'.$base_rest_route.'/choose'; ?>" method="POST">
+<form method="POST">
+	<?php wp_nonce_field('action_name', 'nonce_name'); ?>
 	<div>
 		<input type="checkbox" id="calculation_patch" name="calculation" checked />
 		<label for="calculation_patch">calculation patch</label>
diff --git a/plugins/fbpatch/menu/admin_menu.php b/plugins/fbpatch/menu/admin_menu.php
index 80de664..a6a66c6 100644
--- a/plugins/fbpatch/menu/admin_menu.php
+++ b/plugins/fbpatch/menu/admin_menu.php
@@ -12,45 +12,12 @@ if (!defined('ABSPATH')) {
 
 
 
+
+
 /*
-* the construction of the admin menu page
+* creates the plugin menu
 *
 */
-function plugin_content() {
-	$base_rest_route = Fbpatch::URL_BASE_REST_ROUTE;
-	$fetch_nonce = wp_create_nonce('wp_rest');
-	$fetch_url = get_site_url() . "/wp-json";
-	ob_start();
-		include(plugin_dir_path(__DIR__) . '/html/menu.html');
-	$html = ob_get_clean();
-
-	echo $html;
-}
-
-
-function choose_patches() {
-	error_log("---test---");
-}
-
-
-// handling routes and endpoints
-// diff routes and endpoints : https://stackoverflow.com/q/56075017/9497573
-function admin_menu_routes_endpoints() {
-	$base_rest_route = Fbpatch::URL_BASE_REST_ROUTE;
-	register_rest_route($base_rest_route, '/choose', array(
-		'methods' => 'POST',
-		'callback' => __NAMESPACE__.'\choose_patches',
-	));
-};
-add_action('rest_api_init', __NAMESPACE__.'\admin_menu_routes_endpoints');
-
-
-
-
-
-/*
-* menu plugin
-*/
 function plugin_menu() {
 	$menu_page_title = 'fbpatch';
 	$menu_title = 'fbpatch';
diff --git a/plugins/fbpatch/menu/menu_content.php b/plugins/fbpatch/menu/menu_content.php
new file mode 100644
index 0000000..c763cae
--- /dev/null
+++ b/plugins/fbpatch/menu/menu_content.php
@@ -0,0 +1,58 @@
+<?php
+namespace FBPATCH;
+
+/*
+* it means someone outside wp is accessing the file, in this case kill it.
+*/
+if (!defined('ABSPATH')) {
+	die('You can not access this file!');
+}
+
+
+
+
+/*
+* the construction of the admin menu page
+*
+*/
+function plugin_content() {
+	$base_rest_route = Fbpatch::URL_BASE_REST_ROUTE;
+	$fetch_nonce = wp_create_nonce('wp_rest');
+	$fetch_url = get_site_url() . "/wp-json";
+	ob_start();
+		include(plugin_dir_path(__DIR__) . '/html/menu.html');
+		\FBPATCH\choose_patches();
+	$html = ob_get_clean();
+
+	echo $html;
+}
+
+
+
+
+function choose_patches() {
+	$nonce = $_POST['nonce_name'];
+	if (!wp_verify_nonce($nonce, 'action_name')) {
+		exit;
+	}
+	error_log("is logged in: " . json_encode(is_user_logged_in()));
+}
+
+
+
+//// handling routes and endpoints
+//// diff routes and endpoints : https://stackoverflow.com/q/56075017/9497573
+//function admin_menu_routes_endpoints() {
+//	$base_rest_route = Fbpatch::URL_BASE_REST_ROUTE;
+//	register_rest_route($base_rest_route, '/choose', array(
+//		'methods' => 'POST',
+//		'callback' => __NAMESPACE__.'\choose_patches',
+//	));
+//};
+//add_action('rest_api_init', __NAMESPACE__.'\admin_menu_routes_endpoints');
+
+
+
+
+
+?>