Various small fixes

* Prefill username field by cookie
* Fix non xrds user profile request
* Ignore CSRF token verification from external systems