FIX: check for nil response on JsonCsrf protection

Some reaction do not return a response, think for example drop_session. In that case a nil response
would be returned, see issue #50.