Fix Former::token() using wrong name

The field is intended to be '_csrf' but was the same as the csrf value.