Refactored boilerplates
More boilerplate cleanup.
Moved csrf default config.. er.. back to .config.csrf again.  Sorry, @zolmeister.