EZP-19971 - CSRF protection should be activated by default