Ugh, re-enable the csrf_protection option

Signed-off-by: Gawain Lynch <gawain.lynch@gmail.com>