Fix error in csrf_verify()

When 'csrf_ignored_controllers' is not set in the config, csrf_verify()
would cause an error (invalid type passed to 2nd parameter of
in_array()).
Fix error message in delete_where()