Fix bugs in csrf module

I've found two bugs in csrf module. One with multiple separators "##", and second with checking 'csrf_token' in session.
I've also written tests that simulates these situations.