Add classes to autoload
fix xsrf for session