CSRF protection should be enable by default for all non GET HTTP methods.