CSRF update for new Django session cookies