warn_if_app_base_url_unset() is unconditional—localhost dev also emits a WARN (per csrf.rs doc). The main.rs side note claimed localhost stays silent, contradicting the implementation.