cleanup
there's no need to empty the session header

don’t set it, and it won’t be there
short-circuit auth checks when loading assets

so we don’t needlessly hit the DB
set CSRF token expiry to a week instead of a year
fix failing test
more appropriate error code
small refactoring
don't generate a csrf token if we're not going to use it
Merge pull request #2332 from gittip/2041-revisited

#2041 revisited