fix _csrf and rewrite package.json