Extended identity session to handle CSRF as well. Should be generally compatible, but note that you can no longer disable CSRF.