Check for nil response on JsonCsrf protection

Some reaction do not return a response, think for example drop_session. In that case a nil response will be returned where a rack tuple is expected.