Moved csrf_protection disabling