fixes #4895 - Adds CSRF protection check to the API if a session user is present