update gem

- disable routes
- add csrf meta tag