Enabled csrf_protection by default if form.csrf_protection is enabled