Remove "/?" from resource URLs, add missing csrf_token, fix some errors.