diff --git a/make_post_sell/templates/cart.j2 b/make_post_sell/templates/cart.j2
index 0b45aa9..9da221b 100644
--- a/make_post_sell/templates/cart.j2
+++ b/make_post_sell/templates/cart.j2
@@ -38,14 +38,14 @@
           name        = "cart_id"
           type        = "hidden"
           id          = "cart_id_input"
-          value       = "{{ cart.id }}"
+          value       = "{{ cart.uuid_str }}"
           required />
 
       <input
           name        = "coupon_id"
           type        = "hidden"
           id          = "coupon_id_input"
-          value       = "{{ coupon.id }}"
+          value       = "{{ coupon.uuid_str }}"
           required />
 
       <input type="submit" name="submit" class="mps-submit" value="remove coupon" />
@@ -97,7 +97,7 @@
 
     <div class="cart-item">
       {% if "thumbnail1" in product.extensions %}
-      <a href="/p/{{ product.id }}" rel="nofollow">
+      <a href="/p/{{ product.uuid_str }}" rel="nofollow">
       <img src="{{ request.app["bucket.secure_uploads.get_endpoint"] }}/{{ product.s3_path }}/thumbnail1?ts={{ product.updated_timestamp }}" class="product-cart-thumbnail" />
       </a>
       {% endif %}
@@ -105,22 +105,23 @@
   
     <div class="cart-left-forms">
       <span class="cart-left-item-title">
-      <a href="/p/{{ product.id }}">{{ product.title }}</a> sold by
+      <a href="/p/{{ product.uuid_str }}">{{ product.title }}</a> sold by
       <a href="{{ shop.absolute_about_url(request) }}" rel="nofollow">{{ shop.name }}</a>
       </span>
       <br/>
 
-      <form action="/cart/{{ cart.id }}/quantity" method="POST" onsubmit="submit.disabled = true; return true;" style="display: inline;">
-      <input type="hidden" name="product_id" value="{{ product.id }}">
+      <form action="/cart/{{ cart.uuid_str }}/quantity" method="POST" onsubmit="submit.disabled = true; return true;" style="display: inline;">
+      {% include "snippets/csrf.j2" %}
+      <input type="hidden" name="product_id" value="{{ product.uuid_str }}">
       quantity: <input type="text" name="quantity" class="mps-quantity" value="{{ "{:,}".format(product_quantity) }}">
       <input type="submit" id="submit" value="update" role="button" style="width: 80px;"/>
       </form>
       <br/>
 
-      <!-- change this to a form to prevent CSRF -->
-      <form method="POST" action="{{ request.route_url('cart_remove_product', cart_id=cart.id, product_id=product.id) }}" style="display:inline;">
-  {% include "snippets/csrf.j2" %}
-  <button type="submit" class="cart-remove-link">remove</button>
+      <form method="POST" action="{{ request.route_url('cart_remove_product', cart_id=cart.uuid_str) }}" style="display:inline;">
+      {% include "snippets/csrf.j2" %}
+      <input type="hidden" name="product_id" value="{{ product.uuid_str }}">
+      <button type="submit" class="cart-remove-link">remove</button>
 </form>
     </div>
 
@@ -136,7 +137,7 @@
     <!-- Handling Options -->
     {% if cart.physical_products %}
     <h3>Physical Handling Options</h3>
-    <form action="{{ request.route_url('cart_handling_option', cart_id=cart.id) }}" method="POST">
+    <form action="{{ request.route_url('cart_handling_option', cart_id=cart.uuid_str) }}" method="POST">
       {% if request.shop_location.local_pickup %}
       <input type="radio" id="local_pickup" name="handling_option" value="local_pickup" {% if cart.handling_option == "local_pickup" %}checked{% endif %} required>
       <label for="local_pickup" style="display: inline;">Local Pickup (Free)</label><br>
@@ -206,7 +207,7 @@
     
     {% if not cart.is_empty and request.user == cart.user %}
 
-    <form method="POST" action="{{ request.route_url('user_cart_checkout', cart_id=cart.id) }}">
+    <form method="POST" action="{{ request.route_url('user_cart_checkout', cart_id=cart.uuid_str) }}">
   {% include "snippets/csrf.j2" %}
   <button type="submit" class="cart-checkout-button mps-button">Checkout</button>
 </form>
@@ -224,7 +225,7 @@
     
     {% if request.active_cart == cart and cart.count > 0 %}
     
-    <form method="POST" action="{{ request.route_url('user_cart_save', cart_id=cart.id) }}">
+    <form method="POST" action="{{ request.route_url('user_cart_save', cart_id=cart.uuid_str) }}">
   {% include "snippets/csrf.j2" %}
   <button type="submit" class="cart-save-button mps-button">Save Cart</button>
 </form>
@@ -233,13 +234,13 @@
     {% elif request.active_cart != cart %}
     
       {% if request.user and request.user == cart.user %}
-    <form method="POST" action="{{ request.route_url('user_cart_activate', cart_id=cart.id) }}">
+    <form method="POST" action="{{ request.route_url('user_cart_activate', cart_id=cart.uuid_str) }}">
   {% include "snippets/csrf.j2" %}
   <button type="submit" class="cart-activate-button mps-button">Make Cart Active</button>
 </form>
     <br/>
       {% else %}
-    <form method="POST" action="{{ request.route_url('user_cart_activate', cart_id=cart.id) }}">
+    <form method="POST" action="{{ request.route_url('user_cart_activate', cart_id=cart.uuid_str) }}">
   {% include "snippets/csrf.j2" %}
   <button type="submit" class="cart-activate-button mps-button">Copy & Make Cart Active</button>
 </form>
@@ -251,13 +252,13 @@
     {% if request.user and request.user.owns_cart(cart) %}
     
       {% if cart.is_not_public and cart.count > 0 %}
-    <form method="POST" action="{{ request.route_url('user_cart_public', cart_id=cart.id) }}">
+    <form method="POST" action="{{ request.route_url('user_cart_public', cart_id=cart.uuid_str) }}">
   {% include "snippets/csrf.j2" %}
   <button type="submit" class="cart-public-button mps-button"><span class="lock">&#128275;</span> Make Cart Public</button>
 </form>
     <br/>
       {% elif cart.public %}
-    <form method="POST" action="{{ request.route_url('user_cart_unpublic', cart_id=cart.id) }}">
+    <form method="POST" action="{{ request.route_url('user_cart_unpublic', cart_id=cart.uuid_str) }}">
   {% include "snippets/csrf.j2" %}
   <button type="submit" class="cart-public-button mps-button"><span class="lock">&#128274;</span> Make Cart Private</button>
 </form>
@@ -270,7 +271,7 @@
       {% endif %}
     
       {% if request.active_cart != cart %}
-    <form method="POST" action="{{ request.route_url('user_cart_delete', cart_id=cart.id) }}">
+    <form method="POST" action="{{ request.route_url('user_cart_delete', cart_id=cart.uuid_str) }}">
   {% include "snippets/csrf.j2" %}
   <button type="submit" class="cart-delete-button mps-button">Delete Cart</button>
 </form>