gorilla/csrf App Engine bug

app.go

package app

import (
	"fmt"
	"net/http"

	"github.com/gorilla/csrf"
)

func init() {
	r := http.NewServeMux()
	r.HandleFunc("/", handler)
	http.Handle("/", csrf.Protect([]byte("test"), csrf.Secure(false))(r))
}

func handler(w http.ResponseWriter, r *http.Request) {
	w.Header().Set("Content-Type", "text/html")
	w.Header().Set("X-CSRF-Token", csrf.Token(r))
	fmt.Fprint(w, `<form method="post"><input name="foo"><button type="submit">Submit</button></form>`)
}

app.yaml

runtime: go
api_version: go1

handlers:
- url: /*.
  script: _go_app