Enabling XSS/CSRF by default - was disabled with recent pull of stock CI...

... config file