don't generate csrf token
enable logging
enable authenticity token
use #csrf