this is not BC as ``csrf_provider`` was a ``CsrfProviderInterface`` in 2.3 and below, not a new ``CsrfTokenManagerInterface``