Move CSRF check
Because we're closing the session now before controllers are executed there are cases where we cannot write the session.
Merge pull request #11727 from owncloud/moveCallCheckRegisterToSomeWhereElse

Move CSRF check