preparing to push to heroku
Added clients/users association, temporary CSRF exclude