Fix edge case in XSRF-TOKEN cookie handling

The check must be performed in a NewRequest subscriber rather than a
NewResponse subscriber. Otherwise, the call to get the csrf token may
cause the the session to get out of sync with the cookie because the
NewResponse subscriber runs after the response callback used by the
most session factory implementations to save their state. As a result,
the csrf token is set in the cookie but not saved in the session.