Move Serrano session middleware above CSRF middleware

For token-based authentication using the Serrano API, the CSRF check
is exempted.

Signed-off-by: Byron Ruth <b@devel.io>