unsupport MS Edge (for now, sorry) and some http header nits

app/main.js

@@ -28,6 +28,9 @@ app.use((state, emitter) => {
     ) {
       return emitter.emit('replaceState', '/unsupported/outdated');
     }
+    if (/edge\/\d+/i.test(navigator.userAgent)) {
+      return emitter.emit('replaceState', '/unsupported/edge');
+    }
     const ok = await canHasSend(assets.get('cryptofill.js'));
     if (!ok) {
       const reason = /firefox/i.test(navigator.userAgent) ? 'outdated' : 'gcm';

app/templates/downloadPassword.js

@@ -14,7 +14,7 @@ module.exports = function(state, emit) {
   const div = html`
     <div class="enterPassword">
       ${label}
-      <form id="unlock" onsubmit=${checkPassword}>
+      <form id="unlock" onsubmit=${checkPassword} data-no-csrf>
         <input id="unlock-input"
           class="unlock-input input-no-btn"
           maxlength="64"

app/templates/uploadPassword.js

@@ -9,7 +9,7 @@ module.exports = function(state, emit) {
       <label for="addPassword">
         ${state.translate('requirePasswordCheckbox')}</label>
     </div>
-    <form class="setPassword hidden" onsubmit=${setPassword}>
+    <form class="setPassword hidden" onsubmit=${setPassword} data-no-csrf>
       <input id="unlock-input"
         class="unlock-input input-no-btn"
         maxlength="64"

server/prod.js

@@ -11,16 +11,17 @@ if (config.sentry_dsn) {
 
 const app = express();
 
+routes(app);
+
 app.use(
   express.static(path.resolve(__dirname, '../dist/'), {
     setHeaders: function(res) {
       res.set('Cache-Control', 'public, max-age=31536000, immutable');
+      res.removeHeader('Pragma');
     }
   })
 );
 
-routes(app);
-
 app.use(pages.notfound);
 
 app.listen(config.listen_port);

server/routes/index.js

@@ -51,6 +51,11 @@ module.exports = function(app) {
       }
     })
   );
+  app.use(function(req, res, next) {
+    res.set('Pragma', 'no-cache');
+    res.set('Cache-Control', 'no-cache');
+    next();
+  });
   app.use(bodyParser.json());
   app.get('/', pages.index);
   app.get('/legal', pages.legal);