Plug protect_from_forgery in browser pipeline by default