Plug CSRFProtection by default to browser pipeline