Changed default CSRF handling to null session strategy