fixes #4895 - Adds CSRF protection check to the API if a session user is present
templates - sync from community-templates