csrf time_limit: get value directly from config