fix csrf bug and set up config.py for further use