the xsrf's generation only be decided by RequireXsrf property.