Trying to figure out why CSRF is not disabled