Update SessionMiddleware to bypass CSRF if request token is present

For non-session-based authentication, Serrano resources handle
authenticating using a token based approach. If it is present, CSRF
must be turned off to exempt the resources from the check.