enable post_only attr by default for CSRFDefender plugin