simplify the check for csrfTokenName and csrfToken settings