Move CSRF check

Because we're closing the session now before controllers are executed there are cases where we cannot write the session.

Fixes a regression in master. 
missing the incoming token as first argument