fix(security): validate the CSRF decrypt result instead of trusting that it did not throw

fix(security): validate the CSRF decrypt result instead of trusting that it did not throw #1278