Disable CSRF protection by default