New screens use module pref for CSRF token default