diff --git a/cli_scripts/reset.php b/cli_scripts/reset.php
index 2cc6f1c..6cd3f1f 100755
--- a/cli_scripts/reset.php
+++ b/cli_scripts/reset.php
@@ -1,80 +1,28 @@
-#!/usr/bin/env php
 <?php
-/**
- * ZapMachine Reset Script
- *
- * CLI only. Resets the current session and optionally purges all session
- * folders. Confirmation is required before any destructive action.
- *
- * Usage:
- *   php cli_scripts/reset.php            Reset current session only
- *   php cli_scripts/reset.php --all      Purge all session folders (with prompt)
- *   php cli_scripts/reset.php --all -f   Purge all session folders, no prompt
- */
+session_start();
 
-if (php_sapi_name() !== 'cli') {
-	die('This script can only be run from the command line.' . PHP_EOL);
-}
+unset($_SESSION['imgOriginal']);
+unset($_SESSION['words']);
+unset($_SESSION['folder']);
+unset($_SESSION['collages']);
+unset($_SESSION['width']);
+unset($_SESSION['height']);
 
-// Make sure relative paths in init.php resolve against the project root
-chdir(__DIR__);
+echo '<p>session reset</p><p>';
 
-require_once __DIR__ . '/../conf/init.php';
-
-// Start a session so reset/destroy have something to work with
-if (session_status() === PHP_SESSION_NONE) {
-	session_start();
-}
-
-// --- Session reset ---
-Session::reset();
-
-echo 'Session reset.' . PHP_EOL;
-
-// --- Optional: purge all session folders ---
-$purgeAll = in_array('--all', $argv);
-
-if ($purgeAll) {
-	$force = in_array('-f', $argv);
-
-	if (!$force) {
-		echo 'WARNING: This will permanently delete ALL session folders.' . PHP_EOL;
-		echo 'Are you sure? (type "yes" to confirm): ';
-		$handle = fopen('php://stdin', 'r');
-		$input = trim(fgets($handle));
-		fclose($handle);
-
-		if (strtolower($input) !== 'yes') {
-			echo 'Aborted.' . PHP_EOL;
-			exit(0);
-		}
-	}
-
-	$sessionsDir = ZAP_APP_BASE_DIR . DIRECTORY_SEPARATOR . ZAP_SESSIONS_DIR;
-	$folders = glob($sessionsDir . DIRECTORY_SEPARATOR . '*');
-	$count = 0;
-
-	foreach ($folders as $folder) {
-		if (!is_dir($folder)) {
-			continue;
-		}
-		$files = glob($folder . DIRECTORY_SEPARATOR . '*');
-		foreach ($files as $file) {
-			if (is_file($file)) {
-				unlink($file);
-			}
+if ($_GET['allcollages'] == 'clear') {
+	$sessions = glob('./Sessions/*');
+	foreach($sessions as $folder){
+		$files = glob($folder.'/*');
+		foreach($files as $fileToDelete){
+			echo "$fileToDelete deleted<br />";
+			unlink($fileToDelete);
 		}
+		echo "$folder deleted<br />";
 		rmdir($folder);
-		$count++;
 	}
-
-	echo "Purged $count session folder(s)." . PHP_EOL;
 }
+echo '</p>';
 
-// Only destroy if a session was actually started
-if (session_status() === PHP_SESSION_ACTIVE) {
-	Session::destroy();
-	echo 'Session destroyed.' . PHP_EOL;
-}
-
-exit(0);
\ No newline at end of file
+session_destroy();
+?>
\ No newline at end of file
diff --git a/cli_scripts/test.php b/cli_scripts/test.php
index bb1b29b..3a618cd 100755
--- a/cli_scripts/test.php
+++ b/cli_scripts/test.php
@@ -85,10 +85,9 @@ function testImgSearch() {
 		return;
 	}
 
-	$suffix = bin2hex(random_bytes(4));
-	$folder = ZAP_APP_BASE_DIR . DIRECTORY_SEPARATOR . ZAP_SESSIONS_DIR . DIRECTORY_SEPARATOR . 'search_test_' . ZAP_MOMENT . '_' . $suffix;
+	$folder = ZAP_APP_BASE_DIR . DIRECTORY_SEPARATOR . ZAP_SESSIONS_DIR . DIRECTORY_SEPARATOR . 'search_test_' . ZAP_MOMENT;
 	if (!is_dir($folder)) {
-		mkdir($folder, 0777, true);
+		@mkdir($folder, 0777, true);
 	}
 
 	echo "\nQuery: '$word'\n\n";
diff --git a/lib/ZAPController.class.php b/lib/ZAPController.class.php
index 29df4c8..115b416 100755
--- a/lib/ZAPController.class.php
+++ b/lib/ZAPController.class.php
@@ -26,9 +26,7 @@ class ZAPController {
 		$this->mode = ucfirst($mode);
 		$clazz = $this->prefix . $this->mode;
 		if (!class_exists($clazz)) {
-			http_response_code(404);
-			include getZAPTemplate('404');
-			die();
+			die('Wrong parameter');
 		}
 		$this->action = new $clazz();
 	}
diff --git a/lib/ZAPDisplay.class.php b/lib/ZAPDisplay.class.php
index 65656e9..2d1ef71 100755
--- a/lib/ZAPDisplay.class.php
+++ b/lib/ZAPDisplay.class.php
@@ -28,18 +28,6 @@ class ZAPDisplay implements ZAPHandler {
 	 */
 	public function __construct() {
 		ob_start();
-
-		// Validate CSRF token
-		if (
-			empty($_POST['csrf_token'])
-			|| empty($_SESSION['csrf_token'])
-			|| !hash_equals($_SESSION['csrf_token'], $_POST['csrf_token'])
-		) {
-			http_response_code(400);
-			echo '<p>Invalid or missing security token. Please go back and try again.</p>';
-			die();
-		}
-
 		$this->folder = $this->createFolder();
 		$this->words = $this->handleWords();
 
@@ -61,10 +49,9 @@ class ZAPDisplay implements ZAPHandler {
 	 */
 	private function createFolder() {
 		try {
-			$suffix = bin2hex(random_bytes(4));
 			$folder = ZAP_APP_BASE_DIR . DIRECTORY_SEPARATOR
-					. ZAP_SESSIONS_DIR . DIRECTORY_SEPARATOR . 'zap_' . ZAP_MOMENT . '_' . $suffix;
-			if (!mkdir($folder, 0777, true)) {
+					. ZAP_SESSIONS_DIR . DIRECTORY_SEPARATOR . 'zap_' . ZAP_MOMENT;
+			if (!@mkdir($folder, 0777)) {
 				throw new Exception('<p>' . ERROR_PREFIX . 'Unable to create base dir: ' . $folder . '</p>');
 			}
 			return $folder;
diff --git a/tpl/404.tpl b/tpl/404.tpl
deleted file mode 100644
index 68649d5..0000000
--- a/tpl/404.tpl
+++ /dev/null
@@ -1,29 +0,0 @@
-<!DOCTYPE html>
-<html lang="en">
-<head>
-	<meta charset="utf-8">
-	<title>404 - ZapMachine</title>
-	<link rel="stylesheet" media="screen" href="css/style.css">
-	<style>
-		.error-404 {
-			position: absolute;
-			top: 50%;
-			left: 50%;
-			transform: translate(-50%, -50%);
-			width: 50vw;
-			height: 50vh;
-			display: flex;
-			align-items: center;
-			justify-content: center;
-			font-family: Georgia, serif;
-			font-size: clamp(2rem, 8vw, 6rem);
-			color: #555;
-			border: 0px;
-			background: #fafafa;
-		}
-	</style>
-</head>
-<body>
-	<div class="error-404">error 404</div>
-</body>
-</html>
diff --git a/tpl/index.tpl b/tpl/index.tpl
index 249b112..a5fc6f4 100755
--- a/tpl/index.tpl
+++ b/tpl/index.tpl
@@ -12,11 +12,7 @@
 	<!--input modus: words-->
 	<div id="inpWords" class="inpSection">
 		<h2>Input words</h2>
-<?php if (empty($_SESSION['csrf_token'])) {
-	$_SESSION['csrf_token'] = bin2hex(random_bytes(16));
-} ?>
 		<form id="form1" action="index.php?mode=display" method="post">
-			<input type="hidden" name="csrf_token" value="<?= $_SESSION['csrf_token'] ?>">
 <?php for ($i = 1; $i <= MAX_WORDS; $i++) : ?>
 <?php $nr = sprintf("%02d", $i); ?>
 			<div class="inp">