move csrf middleware up
Only configure NODE_ENV environment; ALL enviroment configuration;  Ensure env configuration exists or exit; Set locals from conf