hum that's a very low level (and buggy) way of checking the session, why don't you use $session->isStarted() instead ?
The second condition should also be `$isCsrfTokenValid === true` (or maybe only `$isCsrfTokenValid`)