CSRF whitelist supports regex

Follows the discussion of #1207. However, the loading sessions exclusion feature is not a part of this.
Add the 'i' modifier, this should be case-insensitive.