fixed test config by disabling CSRF protection