1. This should probably be moved out of the if to be set wether CSRF is enabled or not