Fixed case global csrf_protection is set to false