use token instead of fb_token for auth
modify csrf for api server
add error handers to application controller
file upload for event