csrf: alt validator should check for session auth, not xhr.
release: v0.12.2.