Start testing core CSRF functionality.
Clean up session CSRF