fix: load the configuration first before init csrf

fix: load the configuration first before init csrf #160