Modified application templates so when trying to log in when already logged in it just redirects to homepage instead of throwing exceptions

goBack() will redirect user to his returnUrl
fixes #925

- Turned on CSRF validation by default.
- Application params are now readed before config is defined to be able to use values from params when configuring.
- Added access control for login and logout.