Use timing safe string comparison in CSRF filter

Use a timing safe comparison, as provided by the Symfony Security Component.
Merge pull request #6385 from barryvdh/patch-5

Use timing safe string comparison in CSRF filter