CSRF mitigation hack: reject logins sent with a session cookie.

Configured user agents and logging in as the same user account are
exempted.