disabling CSRF by default. This module is incompatible with the use-case of using node for API development