Move CSRF check

Because we're closing the session now before controllers are executed there are cases where we cannot write the session.

Fixes a regression in master. 
Would require about 30 files to be touched - I'd keep it as is. It is anyways not tested in this file.