CSRF turned off on users