Add option to disable CSRF protection