Fixes #4429 switches csrf token request to a GET from a POST

Removes the warning when the token expires. Does not require a token to get a token.

One downside to this is if you close your laptop and your session expires, when you open your laptop again you no longer get a notice from the failed token refresh.

We could return a logged in flag with the response and check that against what the page thinks the logged in status is and display a message then.