only do csrf protection checks when running on gae