I have a few more questions: 1. Can we inject supertokens as a middleware in our java services instead of having a dedicated service? 2. How does the solution take care of CSRF?