move to 3.0 dev
initial auto csrf protection