Don't double set token with XSRF. Closes #2118