mw.Api: Replace deprecated token names by 'csrf'