update README.md and INSTALL.md
fixbug in csrf token
app.loadCoreTemplates fix #89