Answering my question: there's nothing I need to do. I was looking for a way to set a dummy csrf token during development, but I realised I can just set {:security {:anti-forgery false}} in dev.edn.