[2.9.x] Add system property to enable/disable CSRF protection