Use Rack CSRF & Session::Cookie by default.