version bump. fixed csrf decorator referencing csrf_token which is None on first page load