Added ignore rule to CSRF config (proposed by Steve Esson)