disable CSRF protection, because the client doesn't support it

However the protection should be enabled as soon as possible.

issues: #76
fix bug in random recommendation
hotfix 0.9.7h