remove appcache.pt

We are not deploying appcache currently. This file has become out of
date. More thinking is needed before we can confidently use this
feature.
make a new csrf token on app load

close #243