csrf added, before filters for users controllers, sessions added