remove session referer if csrf fails
Merge branch 'issue-csrf-referer' into develop