EZP-22156: make CSRF provider optional