Moved CSRF override into its own settings file