do CSRF dance after app middleware
release 0.2.13