Rename core.csrf.enabled to csrf.enabled and use true/false instead of 1/0 in xwiki.properties
This will introduce incompatibility, therefore not for 2.5.*