Minor syntax fixes
Deliver CSRF token via cookie and remove hidden form fields and injected js.