Fix EZP-22156: make CSRF provider optional again

This PR resolves issue https://jira.ez.no/browse/EZP-22156

CSRF provider needs to be optional because it will not be available when CSRF protection is disabled.