FIX: session unit tests. Re-add XSRF token as response header.