Fix csrf_token check in api_add_statement()

I messed this up in commit 4da2a2bc42. (mypy probably would’ve caught
it, but I’m not using it in this tool… yet.)

The name is a bit cumbersome because all of csrf_token (obviously),
token (MediaWiki API csrf token) and request_token (OAuth) are already
occupied.