allow overriding restful setting on per-route basis

This way you can default your app to using `restful` but allow individual routes to override the option and accept the csrf token as part of the payload.