generate token in HtmlBuilder frame; use forge method to instantiate a general setting.
add common root when matching routes.
reduced the nest level.
add filters to App; UrlMap to use filters using ApplyFilterTrait.
filter to validate CSRF token.