Ensure AddCsrfToken action provides original context

Fixes #3471

Introduced a wrapped context, so calls to mutable objects in the context
such as the session modify the original context, not the new one.
Merge pull request #3471 from jroper/3471-csrf-session

Cannot modify PLAY_SESSION when calling with no cookie and CSRF token is added to session