add csurf support, and render index.html with jade