fix csrf filter
default layout and index page