Mitigate csrf for authenticated users.
- Use User.Identity.Name as part of connectionToken and verify
  that the token against the user name for all operations.
- Added tests.

#1413