Fix bug in CSRF state persistence when using shared sessions. BaseFacebook loads the stored state in its constructor. However, at that point, the shared session ID has not yet been initialized, so getPersistentData() will return data from the non-shared-session cookie. Since initSharedSession() depends upon state initialized in BaseFacebook::__construct, just re-initialized the stored state in the shared session situation.

Added appropriate tests to check CSRF state persistence with and without shared sessions.