Moved checking of the xsrf tokens to after cache check in $http

As described in #7717, this should increase performance in certain situations.