- added cross-site request forgery prevention token;
- updated to use new 1.4 config