multiple updates

- updates hook handling & hooks
- calls finalize after initialization process
- Toby_Security::validateXSRFKey can be set to return boolean instead of finalization