I don't know much about them specifically, but if they're anything like all the common schemes (http, ftp, ldap, etc), your application would be responsible for

I don't know much about them specifically, but if they're anything like all the common schemes (http, ftp, ldap, etc), your application would be responsible for implementing a security policy. For example, there is nothing about HTTP that implicitly prevents CRSF. However, web servers that speak HTTP pass information about the requester that can be used to prevent CRSF at the application layer.