Add ability to disable CSRF

[ajsharp]

Description 📓

Currently it's not possible to use next-auth without a CSRF token. This makes it impossible to use your next-auth powered API outside a next app. CSRF token's are only used for web app requests bc their point is to protect against XSS attacks.

How to reproduce ☕️

Try to submit an api request without an CSRF token.

Contributing 🙌🏽

Yes, I am willing to help implement this feature in a PR