Added option to set XSRF token cookie as session cookie