Routes now have CSRF filter by default