Update csrf.js

Production systems shouldn't display a detailed error log to potential intruders.