Patch session request with CSRF token