CSRF whitelist supports regex

Signed-off-by: Casey Hancock <crh431@gmail.com>