CSRF whitelist supports regex

Follows the discussion of #1207. However, the loading sessions exclusion feature is not a part of this.
I don't like these custom-made wildcards ... if somebody wants to use regular expressions, better learn them. We don't need to invent new ones.