Support CSRF prevention (double submit cookies)

Currently returns 403 Forbidden if session and
form tokens are empty or not equal.