Move default CSRF checking into core.