use csrf HTTP header
improve app context generation
updateList should always return an array when in updateOnly mode