Only set the XSRF cookie if missing or different