merge app.js
introduce /spotifycsrf to get csrftoken from spotify

and tests