OAuth disables CSRF and makes stateless by default