43: fix CSRF issues, allow CSRF to be used without body parser