Make sure csrf tokens match on client and server.

Perhaps we should log the throwable here.