minor session config tweaks and CSRF ingore rules for auth endpoints
added default gravatar profile pic