Optional arm: SessionPlugin. Omitted → the application has no cookie session and no session-backed form CSRF.

Gated because a session needs a secret nobody can default: the plugin throws during register() without one, so an always-on arm would make every starter application fail to boot until it supplied one. It is also genuinely optional — a token-authenticated API has no use for cookies, which is what auth covers.

Setting csrf additionally registers the synchronizer-token middleware at priority 275, which is the check a progressive-enhancement <Form> post can satisfy — unlike the stateless Origin/Referer check that httpSecurity performs, which a form structurally cannot. Running both is intended.