You need to put this to require as well because its required for the tokengenerator. Without it the csrf component is not really useful.
Also you probably do not need ~2.4. I guess something like ~2.2 is enough (needs examination).
Also its missing HttpFoundation which should probably be in suggest as its needed for SessionTokenStorage.