Change the behavior of getting config in csrf

Use `setdefault` rather than get default.

This change will make app could change the config of CSRF protection while running.