Fix csrf, getModule() method, cleanup ApplicationList trait, add permissions support