Added: CSRF_KEY_LENGTH=16
Fixed: Policy decorator (support control without value)