scrub fields from session, add auth_token and csrf_token to default scrub_fields list