Allow setting CSRF token directly as a config option without using a meta tag.