Turn on request forgery protection, disable CSRF protection