Don't overwrite existing session values in csrf helper.

If there already is a session cookie, don't just overwrite it,
but add the csrfToken to it.

Before, this only worked if the session cookie got set by the current
request, but not if it had already been established by some earlier
request.
Preserve csrfToken if withSession was called.

When, during request processing, withSession was called to create a new,
empty session, CSRF.addResponseToken failed to add the csrf token to the
new session:

In addSessionToken, it checked if the token was already present by looking
at the _request_ header. It failed to notice that the response header
contained a new session without a csrf token.

Fixed by always checking the response header first, and only looking
at the request header if the response header doesn't contain a session
cookie.
Merge pull request #740 from jannic/fix-csrf-session

Don't overwrite existing session values in csrf helper.