Fix EZP-20322: Specify csrf use in REST for use with session based auth