Move CSRF check

Because we're closing the session now before controllers are executed there are cases where we cannot write the session.

Fixes a regression in master. 
This should be passed in as third argument