Removed debug mode, enabled CSRF crumbs, updated README.