refactor csrf token handling, redirect after login page properly using new forms, fix g bug