this seems a bit non obvious .. why set the csrf token default to false if csrf token protection is enabled?