[1.6.x] Fixed bug causing CSRF token not to rotate on login.

Thanks Gavin McQuillan for the report.

Backport of ac4fec5ca2 from master