Don't clobber CSRF token for other scopes

This is another approach for #2640.

If a user is already authenticated in one scope, we should not clobber their CSRF token when they sign into additional scopes in case they have unsubmitted forms.

This still resets the unauthenticated csrf token when the session is authenticated for the first time.