diff --git a/playlist/models/__init__.py b/playlist/models/__init__.py
index 5adb237..9db89c7 100644
--- a/playlist/models/__init__.py
+++ b/playlist/models/__init__.py
@@ -1,3 +1,4 @@
 from .track import Track
 from .artist import Artist
 from .album import Album
+from .vote import Vote
diff --git a/playlist/models/track.py b/playlist/models/track.py
index 8a1557a..d41fe57 100644
--- a/playlist/models/track.py
+++ b/playlist/models/track.py
@@ -1,7 +1,7 @@
 from django.db import models
+from random import choice
 from .album import Album
 from .artist import Artist
-from .utils import from_json
 
 class TrackManager(models.Manager):
     def get_queryset(self):
diff --git a/playlist/models/utils/__init__.py b/playlist/models/utils/__init__.py
deleted file mode 100644
index 9956987..0000000
--- a/playlist/models/utils/__init__.py
+++ /dev/null
@@ -1 +0,0 @@
-from .json import from_json
diff --git a/playlist/models/utils/json.py b/playlist/models/utils/json.py
deleted file mode 100644
index 85988f5..0000000
--- a/playlist/models/utils/json.py
+++ /dev/null
@@ -1,8 +0,0 @@
-def from_json(cls, json):
-    try:
-        return cls.objects.get(pk=json["id"])
-    except cls.DoesNotExist:
-        keys = [f.name for f in cls._meta.get_fields()]
-        subset = {key:json[key] for key in set(keys) & set(json.keys())}
-        return cls.objects.create(**subset)
-
diff --git a/playlist/templates/Base.html b/playlist/templates/Base.html
index f3d963e..dddb075 100644
--- a/playlist/templates/Base.html
+++ b/playlist/templates/Base.html
@@ -3,7 +3,7 @@
     {% load static %}
     <script src="{% static 'js/htmx.min.js' %}" defer></script>
   </head>
-  <body>
+  <body hx-headers='{"X-CSRFToken": "{{ csrf_token }}"}'>
     <header>
       <nav>
         <ul hx-boost="true">
diff --git a/playlist/templates/SpotifyEmbed.html b/playlist/templates/SpotifyEmbed.html
index 02cf6b8..12794d4 100644
--- a/playlist/templates/SpotifyEmbed.html
+++ b/playlist/templates/SpotifyEmbed.html
@@ -1,6 +1,35 @@
-<div id="vote-box" hx-boost="true" hx-target="#vote-box">
-  <iframe src="https://open.spotify.com/embed/track/{{ id }}"
+{% if track %}
+<div id="vote-box" hx-target="#vote-box">
+  {% if error %}<div class="error">{{ error }}</div>{% endif %}
+  <iframe src="https://open.spotify.com/embed/track/{{ track.id }}"
   class="play-sample" width="300" height="380" frameborder="0" allowtransparency="true" 
   allow="encrypted-media"></iframe>
-  <a href="{% url 'vote-track'%}">Ja</a> | <a href="{% url 'vote-track' %}">Nee</a>
+  <div id="vote-buttons" hx-vals='{"spotify_id": "{{ track.id }}"}'>
+    <button
+      hx-vals='{"vote": "2"}'
+      hx-post="{% url 'vote-track' %}"
+    >Helemaal mee eens</button>
+    <button
+      hx-vals='{"vote": "1"}'
+      hx-post="{% url 'vote-track' %}"
+    >Mee eens</button>
+    <button
+      hx-vals='{"vote": "0"}'
+      hx-post="{% url 'vote-track' %}"
+    >Neutraal</button>
+    <button
+      hx-vals='{"vote": "-1"}'
+      hx-post="{% url 'vote-track' %}"
+    >Niet mee eens</button>
+    <button
+      hx-vals='{"vote": "-2"}'
+      hx-post="{% url 'vote-track' %}"
+    >Helemaal niet mee eens</button>
+  </div>
 </div>
+{% else %}
+<p hx-boost="true">
+  Je hebt niets meer om te stemmen. Lekker bezig!
+  <a href="{% url 'nominate' %}">Nomineer zelf iets</a>, als je nog quota hebt.
+</p>
+{% endif %}
diff --git a/playlist/templates/Vote.html b/playlist/templates/Vote.html
index 90b8c0d..98854e8 100644
--- a/playlist/templates/Vote.html
+++ b/playlist/templates/Vote.html
@@ -1,12 +1,8 @@
 {% extends "Base.html" %}
 
 {% block main-content %}
-  {% for song in songs %}
-    {{ song }}
-  {% endfor %}
-
+  <h2>Lekker stemmen</h2>
   <div hx-get="{% url 'vote-track' %}" hx-trigger="load">
-etst
-
+    Laden...
   </div>
 {% endblock %}
diff --git a/playlist/views.py b/playlist/views.py
index a489a3f..43edde2 100644
--- a/playlist/views.py
+++ b/playlist/views.py
@@ -4,23 +4,16 @@ from django.http import HttpResponse
 from django.template.response import TemplateResponse
 from django.contrib.auth.mixins import LoginRequiredMixin
 import re
-from random import choice
-from .models import Track, Artist, Album
-from .models.utils import from_json
+from .models import Track, Artist, Album, Vote
+from .utils import from_json, get_unvoted
 from . import spotify
 
 spt = spotify.Spotify()
 
-# TODO auth mixins
-
 class AuthView(View):
     def get(self, request):
         return TemplateResponse(request, "Login.html", {})
 
-class TrackListView(View):
-    def get(self, request):
-        return HttpResponse("..")
-
 class TrackDetailView(LoginRequiredMixin, View):
     def get(self, request, spotify_id):
         try:
@@ -35,11 +28,28 @@ class VoteView(LoginRequiredMixin, View):
         return TemplateResponse(request, "Vote.html", {"songs": songs})
 
 class VoteTrackView(LoginRequiredMixin, View):
-    def get(self, request):
-        pks = Track.objects.values_list('pk', flat=True)
-        track = Track.objects.get(pk=choice(pks))
-
-        return TemplateResponse(request, "SpotifyEmbed.html", {"id": track.id})
+    def get(self, request, error=None):
+        track = get_unvoted(request.user)
+        return TemplateResponse(request, "SpotifyEmbed.html", {"track": track, "error": error})
+    def post(self, request):
+        try:
+            spotify_id = self.request.POST['spotify_id']
+            score = int(self.request.POST['vote'])
+            score = min(max(-2, score), 2)
+            track = Track.objects.get(pk=spotify_id)
+            try:
+                Vote.objects.get(user=request.user, track=track)
+            except Vote.DoesNotExist:
+                pass #expected behaviour
+            else:
+                raise Exception(f"{request.user} already voted for {track}")
+            Vote.objects.create(track=track, user=request.user, points=score)
+            print(track)
+        except Exception as e:
+            print(e)
+            return self.get(request, str(e))
+        else:
+            return self.get(request)
 
 class NominateView(LoginRequiredMixin, View):
     def get(self, request):
