CSRF protection should optionally be enabled as part of the default interceptors