I think we should keep our API simple. In most cases, you would like to disable CSRF for the whole controller (e.g. rest controller). In some special case when you want to disable CSRF for some actions only, it's likely there's some complex conditions involved to determine this.