Remove CSRFDefender from core dist. I shipped its own tar ball on cpan.