fixed broken CSRF tests, added exemptions, general code cleanup