Update ROADMAP.md
Update ROADMAP.md
Merge remote-tracking branch 'core/master'
New csrf test

CSRF config ::
    ...
    with CSRF set to {protectionEnabled: true, routesDisabled: '/user'}
        ✓ a POST request on /user without a CSRF token should result in a 200 response
        ✓ a POST request on /test without a CSRF token should result in a 403 response