Fix client side CSRF issues, remove canvas support and cleanup readme