Fix security component failing on csrf tokens.

The `_csrfToken` field should be ignored when validating post data.

Refs #5100
No, actually the Model key would not exist either. It is not relevant for the year, though.