null_session for csrf via api; and some template tweaks
upgrade assets
removed inherited resources collection hack, 'cause I ain't using inherited resources (for now?)
remember token now works