Added automatic reading of app.protect_from_csrf setting