Add CSRF constructor to configure token checking in request headers