enable xsrf by default