moving readme out of root and changing CSRF to false in config