Added switch for CSRF into config.