On OS X it's always /usr/local

the global option is for linux, which has a differennt postinst script
setup csrf protection in deb install
RPM sets csrf protection
First run at windows csrf setup