[4.1] Removed CSRF from signed request

Discovered this while writing documentation for `Facebook\Entities\SignedRequest`. The signed request payload [doesn't support the `state` param](https://developers.facebook.com/docs/reference/login/signed-request/) for CSRF. So I killed it. :)

[The docs](https://developers.facebook.com/docs/facebook-login/using-login-with-games#confirm) recommend we validate the signed request against CSRF by validating against the user data from the JavaScript SDK.