Links for users without a session are not CSRF checked

Routes with the _csrf_token requirement always failed the CSRF check if there was no session started because the CSRF seed was not stored anywhere. Now the CSRF token will only be added to the link if the user has a session irregardless whether they are logged in or not.