For now I've just kept it simple for per action CSRF configuration.  I don't know yet if anyone will even find it useful.  A global CSRFFilter is the recommended way to do things.  So my approach is keep it simple, and when people have use cases for more functionality, then we can provide that.