Moving the CSRF settings to the primary index file so that they're available when the CSRF protection is actually ran. That's what I get for not testing that one before committing.