DefaultTokenExchangeRequestComposer misses the csrf token

[stevehu]

in the request body construction. This will cause the jwt token generated without csrf token and break the csrf verification in the msal token exchange handler on the BFF.