first production setup & blaming  CSRF bug on chrome settings :)

* serving HTMLs as statics only temporary - not suitable for production
* CSRF works on firefox (comment @csrf_exempt)