This is wrong. As you moved the loading of ``security.xml`` into the method, it must always be called.

Please add a test checking that ``security.secure_random`` is available when disabling CSRF.