Preserve csrfToken if withSession was called.

When, during request processing, withSession was called to create a new,
empty session, CSRF.addResponseToken failed to add the csrf token to the
new session:

In addSessionToken, it checked if the token was already present by looking
at the _request_ header. It failed to notice that the response header
contained a new session without a csrf token.

Fixed by always checking the response header first, and only looking
at the request header if the response header doesn't contain a session
cookie.