Add CSRF token for login with token auth.
Merge remote-tracking branch 'upstream/token-csrf' into 7.x-1.x