If the state is null don't check for CSRF

When the state is not set or has done it's job  (nullified)  return false