fix browser default tests: disable CSRF transform rather than try to normalize output