add possibility to disable CSRF token validation