bug fix: changed csrf to null_session, also changed app server to thin