fix for xsrf token
version change and release notes