Use csrf cookies by default (not in session)