[#61178164] Require csrf token when using session validation

 - csrf token is required for non get requests when using session based authentication
 - csrf token is not required for api key based authentication
 - if an api key is provided, authenticate only with the api key ignoring any session provided