Adding wtf.  And updated CSRF settings, so that they've retrieved from run.sh in development and Heroku when running there.