Actually enable CSRF protection.