updated fabfile, csrf cookies permissions