fix(csrf): in storage policy, use base_url as path instead of route_prefix which can be None

#1017 (closed)