code: private HttpSecurity handleCsrf(final HttpSecurity http)
              throws Exception {
          if ("test".equals(activeProfile)) {
              return http.csrf().disable();
          } else {
              return http.csrf().ignoringAntMatchers(
                          "/gedbrowserng/v1/login",
                          "/gedbrowserng/v1/signup")
                      .csrfTokenRepository(
                              CookieCsrfTokenRepository.withHttpOnlyFalse())
                      .and();
          }
      }
docs: Work from the http security object and enable or disable CSRF handling,
  as requested in the application properties.
  
  @param http the http security object
  @return the http security object
  @throws Exception if there is a problem