Enable CSRF protection

[hndrewaall]

There are two levels of CSRF protection in place, and both are manually disabled everywhere. We should decide if we even need both of these, and remove the overrides.

Additionally, where appropriate, we should conditionally disable these based on test config