Fix client-side CSRF issues, remove canvas support and cleanup readme

Should fix #70, amongst others.