Add configuration to disable forgery protection in the test environment

[matthewmcgarvey]

Now that luckyframework/lucky#1657 is merged, new projects should have CSRF protection turned off while running tests. We'll need to find the best place for it to live in the config/ directory.

[bararchy]

I would say that the authentic file might be a good candidate as it works with authentication and security?
Cookies seems like a 2nd best, but because the CSRF isn't sent via cookies and instead is used as a form param I would say authentic or application makes the most sense to me