add csrf and remove prologue theme