change get config behavior of csrf