CSRF path broken by encoding

[aaronhaslett]

Path is being ignored on current firefox because it's sent as str(path.encode('latin1')) which comes out as "b'/path'" because str() of bytes is weird.