disable XSRF protection in all environments