Move csrf().disable() to init of configurer