Fixes #4895: Adds CSRF protection check to the API if a session user is ...

...present.