fix skip csrf check
fix log model
fix xml render
add session.secret to account.json