disable csrf validation for base config