Fix API CSRF Protection and login CSRF

https://www.openproject.org/work_packages/7562

This also fixes login CSRF. See code comments for more information.