Corrected CSRF token default