Remove csrfToken if disable-xsrf-protection is true (#14111)

If the server sends no token and the client value remains "init" then
it's not sent back to the server.

Change-Id: I74fc470c5c22d57c4a48eab3e4476ae4cc2dd242