Security; actually check CSFR token is what we expect

This broken code is new and hasn't been released properly so no release for this needed.