You should only disable the csrf token if the parameter ``form.type_extension.csrf.enabled`` is true