[FrameworkBundle] CSRF should be on by default