Add default for csrf

Signed-off-by: Gawain Lynch <gawain.lynch@gmail.com>