when CSRF tokens do not match, check for session creation and ignore. closes #4