Fix CSRF new session detection. This should fix the Jenkins Selenium build.

Occasionally Spring security will invalidate and create a new session
to protect against session fixation attacks (see
SessionFixationProtectionStrategy). This would mark a session as new,
even though if contains the correct CSRF token. Now we just check for
the presence of the session CSRF token to give an appropriate error
message.