remove csrf on login form and finish #100