fix typo in CSRF setting, fix pep8 issues