pre-router hook like csrf added, auth controller improved, forgotten-password feature started