Adjust config to so key required at base level
and turn off csrf in dev