New option for csrf
You can disable csrf for a route with module.exports.csrf.routesDisabled
Merge remote-tracking branch 'core/master'
New csrf test

CSRF config ::
    ...
    with CSRF set to {protectionEnabled: true, routesDisabled: '/user'}
        ✓ a POST request on /user without a CSRF token should result in a 200 response
        ✓ a POST request on /test without a CSRF token should result in a 403 response
Merge pull request #2121 from mhxz/master

New option for csrf