Fix csrf validation without time limit (time_limit=False)

With `time_limit=False`, `generate_csrf` will generate a token with an empty `expires` value. The `validate_csrf` function will always fail because it tries to parse an empty string as float. We should parse this value only if we care about the `time_limit`.