Fix EZP-20785: only validate CSRF token when a session is running