Use null sessions instead of exceptions when CSRF error occurs.