fix CSRF token scraping from their layout change

That happened on 2/7/2013 it seems.