Use sessions and provide CSRF token to front-end JavaScript