fixed csrf hook, env default, and config extention