make CDN a global var
use .json for specificity
better app server
make _csrf generation async
thumbnail support
fix ssl middleware