add csrf rule for login,
patch autoload,
patch exception,
complete CSRF protection,
patch controller