[FrameworkBundle] Csrf configuration + exception if no session
[FrameworkBundle] Disable csrf by default (since it depends on session)