Fix #32 dont escape twice in CSRFProtection

Some characters in the token were escaped badly before this
Merge pull request #34 from standout/fix-csrf-protection

Fix #32 dont escape twice in CSRFProtection