don't expose csrf token to google

This prevents the csrf token from being exposed to google and also removes the csrf token from being displayed in the search log.

```
$ cat search.log 
1361071738096 a&x-csrf-token=7QRvHH%2FvlUCKQC3HWIESYvOLt6pVqkli8EFe4IBh
1361071993462 a&x-csrf-token=7QRvHH%2FvlUCKQC3HWIESYvOLt6pVqkli8EFe4IBh
1361073043309 cool
1361073094835 a
1361073336567 cool
1361073645001 cool
```