Use `return {}` idiom for csrf
Use `return {}` idiom for csrf

Not sure why we reverted this in 24b8cf51e777. The tests still pass
without setting state early.

mccolgst/www.gittip.com,gratipay/gratipay.com,gratipay/gratipay.com,mccolgst/www.gittip.com,eXcomm/gratipay.com,gratipay/gratipay.com,eXcomm/gratipay.com,mccolgst/www.gittip.com,studio666/gratipay.com,studio666/gratipay.com,gratipay/gratipay.com,eXcomm/gratipay.com,eXcomm/gratipay.com,mccolgst/www.gittip.com,studio666/gratipay.com,studio666/gratipay.com