CSRF token provider / manager substitution is rewritten to be generic