read CSRF_DISABLE dynamically instead of caching on init