def METHOD_NAME(self, form):
    # CSRF protect. DO NOT use auto CSRF protection for adding a site
    alsoProvides(self.request, IDisableCSRFProtection)
    self.request.response.setHeader('Content-type', 'application/json')
    extension_ids = form.get('extension_ids[]', [])
    extension_ids.append('castle.cms:default')
    # TODO: barceloneta needs to just be removed
    if 'plonetheme.barceloneta:default' in extension_ids:
        extension_ids.remove('plonetheme.barceloneta:default')
    site_id = form.get('site_id', 'Castle')
    try:
        site = addPloneSite(
            self.get_creation_context(site_id),
            site_id,
            title=form.get('title', ''),
            profile_id=form.get('profile_id', _DEFAULT_PROFILE),
            extension_ids=extension_ids,
            setup_content=form.get('setup_content', True),
            default_language=form.get('default_language', 'en'),
            portal_timezone=form.get('portal_timezone', 'UTC')
        )
        # delete news/events since they have default pages attached to them
        api.content.delete(objects=(site['news'], site['events']))
        install.tiles(site, self.request)
        # need to reindex
        catalog = api.portal.get_tool('portal_catalog')
        catalog.manage_catalogRebuild()
        combine_bundles(site)
        if DYNAMIC_STORAGE_ENABLED:
            url = '{}/sites/{}'.format(self.context.absolute_url(), site_id)
        else:
            url = '{}/{}'.format(self.context.absolute_url(), site_id)
        # we do not allow basic auth
        acl_users = site.acl_users
        acl_users.manage_delObjects(['credentials_basic_auth'])
        cookie_auth = acl_users.credentials_cookie_auth
        # this is relative to [site]/acl_users/credentials_basic_auth
        # otherwise, doing /login on a site would redirect to [root]/@@secure-login
        cookie_auth.login_path = u'../../@@secure-login'
        return json.dumps({
            'success': True,
            'url': url
        })
    except Exception as e:
        LOGGER.error('Error creating site', exc_info=True)
        transaction.abort()  # abort creating this site if there was an error
        return json.dumps({'success': False, 'msg': str(e)})