Fix hgignore.
Another place missing csrf header.