Removed csrf-param element, changed User element type to ref
Removed csrf-param from Session structure, changed CSRF token to be transported via header