Fix security component failing on csrf tokens.

The `_csrfToken` field should be ignored when validating post data.

Refs #5100