I think the code would be a bit clearer without this crumbRequired field. Currently there are 2 conditions that determine wether the CSRF token should be fetched - this field and the check below if the method == POST.

I don't think this field will ever be false, right? If this is the case, I think we could just remove it.