Fix csrf token usage
Ensure session key creation works