The SecureRandom definition should not depend on the activation of CSRF