Make sure to set the CSRF cookie too on basic auth

If not set explicitely, command-line tools such as cURL will still throw an 'Invalid cookie token' error on CSRF authentication.