Added CSRF flag to config object