Allow CSRF protection to be disabled in any environment