Added a different exception handing scheme for CSRF 'null_session' for quick security fix