Fix NPE in CSRF filter