csrf defaults to null so as not to break views when disabled but used