return false for invalid base64 csrf tokens.