removed ability to toggle on/off redirects and csrf not needed, moved csrf to middleware