Use maybeApplication in CSRF and Crypto

You should use a `def` instead of a `val` here because `Play.maybeApplication` is not a stable reference. (Note that the existing implementation was buggy too)