Allow bypassing CSRF protection by setting res.bypassCsrf true