CSRF token should be sent as last parameter in request payload

[jwbth]

Currently the order of parameters (specified at https://github.com/macbre/nodemw/blob/devel/lib/bot.js#L494) doesn't comply to the API documentation. It specifies that "The token should always be sent as the last parameter, or at least after the text parameter."

This may result in cropped content if the connection was terminated abruptly, as can be seen in this edit performed by nodemw.