Short-circuit the solution logic if CSRFGuard is disabled

[forgedhallpass]

If CSRFGuard is disabled:

• The configurations should be lazily initialized: e.g. no validations, no class instances creation with reflection etc.
• No tokens should be (pre)created by the onSessionCreate
• The JavaScriptServlet should not serve the regular JS file that makes an additional request, tries to inject tokens to DOM elements and so on.

[forgedhallpass]

Fixed by:

• Resolve code smells OWASP/www-project-csrfguard#22
• OWASP/www-project-csrfguard@bab511d
• OWASP/www-project-csrfguard@5a6e85d