CSRF whitelist matching supports robust api urls
Updated changelog.

Signed-off-by: Casey Hancock <crh431@gmail.com>