[backend] remove csrf-meta from partial bodies

Fixes #4531