Core: make sure an action can redirect when the CSRF token is invalid