Remove duplicate.
Set session expiry to 15 minutes (#79).
Enable anti-CSRF middleware (#78).