Disable CSRF protection by default to prevent potential BC break
To enable it use `options` variable, i.e.:

```
hwi_oauth:
    resource_owners:
        github:
            type:                github
            client_id:           <client_id>
            client_secret:       <client_secret>
            options:
                csrf:            true