Remove js deps, allow auth test, add crsf protection.