improved csrf regexp