Switch off csrf to start