(fix): plotly fix, preparation for full server bundle and xsrf token re-introduced