Update nancy and turn off CSRF