Why is this change necessary? Can we move it into a separate PR? I'm probably misunderstanding something, but this looks like it would completely disable CSRF checks.