added underscore.js
adding csrf.js