update docs and code to support latest respite with fixed CSRF handling

update docs and code to support latest respite with fixed CSRF handling