csrf: fix typo (enumerabe -> enumerable)

[Mozilla Doc: Object.defineProperty](https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Object/defineProperty#Description)