If CSRF protection is disabled you just skip token validation and the rest stays the same, you still return UserSession.
For the case when CSRF protection is enabled and token is not valid, UnauthorizedException should be thrown, as is done in CSRF listener: https://github.com/ezsystems/ezpublish-kernel/blob/master/eZ/Bundle/EzPublishRestBundle/EventListener/CsrfListener.php