Set post_only attr for CSRFDefender, by default.