added config for csrf-magic; auto-check authentication if backend is called; auto-use csrf-magic in backend