CSRF whitelist supports regex

Follows the discussion of #1207. However, the loading sessions exclusion feature is not a part of this.
Actually ... make it like this:

    if (preg_match('#^'.$excluded.'$#i'.(UTF8_ENABLED ? 'u' : ''), $uri->uri_string()))