Update config.php

no csrf by default