Ensure AddCsrfToken action provides original context

Fixes #3471

Introduced a wrapped context, so calls to mutable objects in the context
such as the session modify the original context, not the new one.