Fix misspelling of csrf

This will fix http://www.senchalabs.org/connect/csrf.html, right? (I have no idea!)