making csrf inclusion configurable since it can create serious issues if NodeBootstrap is used for developing RESTful APIs