add CSRF protection in webapp
remove ujson import in api.reporting.py