add CSRF for AngularJS, other minor fixes