update composer.json, clean up comment from routes, add app/storage to .gitignore
Add CSRF protection filter to all POST routes. clean up routes file; Use auth filter instead of controller logic; Rename login GET route to loginForm.