Use recycle in tests
Only generate CSRF token in non-protected methods