Is this correct? Looks like it should be:

`if (!$config['csrf']['enabled'] || ($config['csrf']['enabled'] && $csrftoken->valid)) {`