wrong documentation as it also accept a CsrfProviderInterface