Refactor CSRFToken.validate to increase coverage
Test CSRFToken.validate without cookies