I'll have to try and contact the original source of the fix as all I did was ported over. But now that I pay a bit more attention to it, I agree it doesn't make sense to check if the csrfTokenEnabled is true to set the default option to false.