Don't check against CSRF if there was no state (code) generated.

If in a signle handler you call the getCode twice, the function
logs that there was a Token mismatch at ERROR level. This is not
valid because the functions resets the state but forgets to check
against it.