More changes

- nosurf is now the CSRF handler.
- JSON Config
- Login and Signup handlers almost completed