make Request more robust against invalid CSRF data

fixes #4514