Move csrf to beginning of app initialization