Move CSRF check

Because we're closing the session now before controllers are executed there are cases where we cannot write the session.

Conflicts:
	lib/private/server.php