Fix vulnerability of lack of token

Csrf\getError() returns null if there is no token field. As a result, the check is aborted without adding an error.

app/Core/Validator.php

@@ -708,7 +708,7 @@ class Validator
             ! \is_string($value)
             || ! $this->c->Csrf->verify($value, $attr, $args)
         ) {
-            $this->addError($this->c->Csrf->getError(), 'e');
+            $this->addError($this->c->Csrf->getError() ?? 'Bad token', 'e');
 
             return null;
         } else {