csrf: Check for 'csrf' substring in input names and values

[Issue #484]