improved bad csrf token error message
cleaned up wording of config
improved leadtime defaults in getCSRFToken