Disable CSRF protection in test mode

By disabling this protection, we can now test dynamic forms (involving javascript to generate needed fields) by submitting directly the known values to action URI.


*Not possible if fields are generated by JS* 

```
$client->submit($form, array(
    'form[tags][0]['value'] => 'foo',
    'form[tags][1]['value'] => 'bar',
));
```

*Not possible if CSRF is enabled*
```
$client->request('POST', '/uri/to/action', array(
    'form' => array(
        'tags' => array(
            array('value' => 'foo'),
            array('value' => 'bar'),
        ),
    ),
);
```