add file/do_multipaste to CSRF exception list

This is only needed for clients not yet using api keys.

Signed-off-by: Florian Pritz <bluewind@xinu.at>