To clarify, how 'csrf_protection' is handled here is not that important, but a boolean cast for 'allow_get_array', 'global_xss_filtering' will cause headaches for people who (for some reason) don't have these items in their config files.