Fix security component failing on csrf tokens.

The `_csrfToken` field should be ignored when validating post data.

Refs #5100
Since this is 3.0, should the field be nested under Model key?