CSRFDefender: Added `no_html_filter` parameter.