CSRF_ENABLED renamed to WTF_CSRF_ENABLED

It seems the correct parameter for flask-wtf is WTF_CSRF_ENABLED