Dev Moved CsrfValidation configuration to internal.php
Dev This allows users to override it properly via config.php