Fix the csrf token header to use the experimental prefix, as required by the HTTP standard.
Fix the debug output on each session validation.
Fix the tag parsing.