Fix EZP-20785: only validate CSRF token when a session is running

See https://jira.ez.no/browse/EZP-20785.

The title says it all.

# Testing
1. Try to run an unsafe operation using REST with basic auth (create content). Check that it doesn't fail.
2. Create a session using REST (see the --session HTTPie option in recent versions), try to log out (DELETE /user/sessions/<id>) without a CSRF token => should fail, try to log out without it => should succeed