Set a more helpful message for the CSRF callback exception

Without this it's hard to see that it was a CSRF protection issue, since it just shows as an invalid credentials issue.