$config['error']['lurk'] was last used in 2010 I think
$config['referer_match'] = false to disable
CSRF more mod pages