What They’re Saying About EE
Right from the horse’s mouth, you could say:
don't poo-poo the importance of CSRF. #eecms protects you application-wide, even for add-ons—unless you turn it off! http://t.co/VRsN1k6pKY
— EllisLab (@EllisLab) March 12, 2015
Keep CSRF enabled!