There must be a log entry (most likely an exception) in the error.log, which gives more information about this statuscode 500. Can you share that exception?
(Very unlikely that the CSRF filter is causing this. Because a few user agents are explicitly listed, which are ignored by the filter.)