adding sessions and csrf

added token

sessions working

bug removed