Makes the CSRF bypass controllers list configurable and allows it to reference controllers within the main controllers folder. Fixes #967