Fix 'Array to string conversion' notice in CSRF validation

Rel: #3398