EZP-22220: Moved CSRF token generation after authentication occured

This avoids the session to start if authentication failed.
Also removed manual session start since it's not needed. CsrfProvider will do it seamlessly.