Fixes #4429 switches csrf token request to a GET from a POST
adds session expired message client side
Merge pull request #5807 from cash/csrf_token

Fixes #4429 switches csrf token request to a GET from a POST