Move CSRF check

Because we're closing the session now before controllers are executed there are cases where we cannot write the session.

Fixes a regression in master. 
Maybe CSRFProtection is a better name :)