Fix #32 dont escape twice in CSRFProtection

Some characters in the token were escaped badly before this