Altered CSRF whitelist matching to allow for simple, robust exclusions

Signed-off-by: Casey Hancock <crh431@gmail.com>