Wait to get the initial csrf request until dom load.

This keeps steal.build from trying to include 'csrf' as a file that needs compressed.