The comment is IMHO not really necessary since the name speaks for itself and it kind of separates this from the rest of the CSRF related settings.