XNAT-4327 Removed additional code that set CSRF token. All token sets should now be done only in session event publisher at the point when the session is actually created.