csrf: tidy up code.
csrf: provide alternative validator for authenticated XHRs.
release: v0.12.1.