Fix security component failing on csrf tokens.

The `_csrfToken` field should be ignored when validating post data.

Refs #5100
One _could_ nest arrays. I was mostly being lazy and didn't want to try computing a new hash for this test.