Changed csrf strategy to null session.