Configuring CSRF protection