refactored CSRF
removed persist_session as it is now automatic and fixed headers bug
adde helpers for REST macros and connection that aid testing handlers