Tweak CSRF protection in all session mappers