fixes #4895 - Adds CSRF protection check to the API if a session user is present

Replaces #1331 with added tests (had to rework how we only applied this to session users)