Fixing invalid csrf token when session expires

Basically when the session expires or simply the user removes the
phpsessid cookie the site won't work anymore, unless you refresh the
page completely.

Problem is when the user makes a request when the session expired, the
csrf check will always fail since $_SESSION['phery']['csrf'] will always
be empty therefore it goes into a loop and tries to resend a new csrf
token on every request from that point. (Only when it's resent on fails
of course.)