Update csrf.go

Added hash separator