patch in csrf-magic; removed some index.php (installer will create them automatically)