Enables CSRF protection for API calls when there is a session user

present.