profile in progress, relative links now work, csrf is angular-compatible