Do not have the CSRF protection kick in when user is not logged in. This is unnessecary and prevents the auto saving of submitted form data from working