Using env instead of config files and Skipping CSRF protection for Okta callback.