csrf-token and bug fixes