fix auto csrf tests

(currently) plone.transformchain reraise only ConflictError exceptions, so IMHO current tests that make checks on Forbidden exceptions don't are good.