Add config for local development. Add XSRF protection. Some minor changes.