Yes.  This is just for Java action composition, for per request processing.  Java users can still use the CSRFFilter, and possibly provide a custom TokenGenerator that way.  We could have an annotation parameter that supplied a TokenProvider class.  But my reason for not adding this functionality to per action processing was to keep it simple - generally you would want to have the same configuration application wide, so it doesn't make sense to configure it at the per action level.