If the user has explicitly disabled CSRF protection in a custom SecurityFilterChain, we should be able to back off and not try to disable it just for the gRPC endpoints (accidentally switching it back on for the other endpoints). Fixes gh-142