EZP-22220: Removed manual session start

It's not needed since the CsrfProvider will do it anyway to generate the CsrfToken.