[FrameworkBundle] Only enable CSRF protection when enabled in config