Actually a ``setDefaults`` with ``'csrf_protection' => false`` seems to do the trick (if the option is not defined, the setDefaults will define it but juste ignore it).