update composer
fix #218 add config $core_config['init']['ignore_csrf'] to bypass CSRF validator