Use timing safe string comparison in CSRF filter

Use a timing safe comparison, as provided by the Symfony Security Component.