Changed CSRF handling to be a double submit cookie