[FIX] Do not use CTOKEN if CSRF disabled

* [FIX] Workers page not checking for CTOKEN properly

Fixes #1848 once merged.