SEC-2347: CSRF Enabled by default w/ XML Config
SEC-2348: Update doc headers enabled by default with XML