Shouldn't CSRF be intialiased in init?