diff --git a/app/main.js b/app/main.js
index 7db1e4bf..8888718f 100644
--- a/app/main.js
+++ b/app/main.js
@@ -28,6 +28,9 @@ app.use((state, emitter) => {
     ) {
       return emitter.emit('replaceState', '/unsupported/outdated');
     }
+    if (/edge\/\d+/i.test(navigator.userAgent)) {
+      return emitter.emit('replaceState', '/unsupported/edge');
+    }
     const ok = await canHasSend(assets.get('cryptofill.js'));
     if (!ok) {
       const reason = /firefox/i.test(navigator.userAgent) ? 'outdated' : 'gcm';
diff --git a/app/templates/downloadPassword.js b/app/templates/downloadPassword.js
index 324e8d24..4ce13608 100644
--- a/app/templates/downloadPassword.js
+++ b/app/templates/downloadPassword.js
@@ -14,7 +14,7 @@ module.exports = function(state, emit) {
   const div = html`
     <div class="enterPassword">
       ${label}
-      <form id="unlock" onsubmit=${checkPassword}>
+      <form id="unlock" onsubmit=${checkPassword} data-no-csrf>
         <input id="unlock-input"
           class="unlock-input input-no-btn"
           maxlength="64"
diff --git a/app/templates/uploadPassword.js b/app/templates/uploadPassword.js
index 509bf36e..216f2fad 100644
--- a/app/templates/uploadPassword.js
+++ b/app/templates/uploadPassword.js
@@ -9,7 +9,7 @@ module.exports = function(state, emit) {
       <label for="addPassword">
         ${state.translate('requirePasswordCheckbox')}</label>
     </div>
-    <form class="setPassword hidden" onsubmit=${setPassword}>
+    <form class="setPassword hidden" onsubmit=${setPassword} data-no-csrf>
       <input id="unlock-input"
         class="unlock-input input-no-btn"
         maxlength="64"
diff --git a/server/prod.js b/server/prod.js
index 7c5af6bb..2840f9ec 100644
--- a/server/prod.js
+++ b/server/prod.js
@@ -11,16 +11,17 @@ if (config.sentry_dsn) {
 
 const app = express();
 
+routes(app);
+
 app.use(
   express.static(path.resolve(__dirname, '../dist/'), {
     setHeaders: function(res) {
       res.set('Cache-Control', 'public, max-age=31536000, immutable');
+      res.removeHeader('Pragma');
     }
   })
 );
 
-routes(app);
-
 app.use(pages.notfound);
 
 app.listen(config.listen_port);
diff --git a/server/routes/index.js b/server/routes/index.js
index 69479dd7..4493c7d5 100644
--- a/server/routes/index.js
+++ b/server/routes/index.js
@@ -51,6 +51,11 @@ module.exports = function(app) {
       }
     })
   );
+  app.use(function(req, res, next) {
+    res.set('Pragma', 'no-cache');
+    res.set('Cache-Control', 'no-cache');
+    next();
+  });
   app.use(bodyParser.json());
   app.get('/', pages.index);
   app.get('/legal', pages.legal);