Model-Based Detection of CSRF