Don't overwrite existing session values in csrf helper.

If there already is a session cookie, don't just overwrite it,
but add the csrfToken to it.

Before, this only worked if the session cookie got set by the current
request, but not if it had already been established by some earlier
request.