Handle bogus values passed to `_xsrf`