SEC-2498: RequestCache allows POST when CSRF is disabled