update app controller for json output and csrf token