csrf: Allow add_csrf() to work with a NULL varlist

If add_csrf() was passed a NULL template varlist it would fail to add a
token to the list.

We need to do the same we do with add_html_var(). We create a NULL vlist
that gets the return value from TMPL_add_var() and then we return that
which can be picked up the caller of add_csrf() if needed.

Signed-off-by: Andrew Clayton <andrew@digital-domain.net>