Use const CSRFToken instead of magic string

In the Edit method, replace magic string "csrf" with const CSRFToken in
argument to GetToken.