Fixed exception being always instantiated

Exception was always created regardless if an error was actually there. What's more, it was created in one place, so it was impossible to determine which of the two code paths was taken.

Author: Steveb-p

src/lib/Server/Controller/SessionController.php

@@ -217,13 +217,8 @@ private function checkCsrfToken(Request $request)
             return;
         }
 
-        $exception = new UnauthorizedException(
-            'Missing or invalid CSRF token',
-            $request->getMethod() . ' ' . $request->getPathInfo()
-        );
-
         if (!$request->headers->has('X-CSRF-Token')) {
-            throw $exception;
+            throw $this->createInvalidCsrfTokenException($request);
         }
 
         $csrfToken = new CsrfToken(
@@ -232,7 +227,7 @@ private function checkCsrfToken(Request $request)
         );
 
         if (!$this->csrfTokenManager->isTokenValid($csrfToken)) {
-            throw $exception;
+            throw $this->createInvalidCsrfTokenException($request);
         }
     }
 
@@ -263,6 +258,14 @@ private function getAuthenticator(): ?AuthenticatorInterface
 
         return $this->authenticator;
     }
+
+    private function createInvalidCsrfTokenException(Request $request): UnauthorizedException
+    {
+        return new UnauthorizedException(
+            'Missing or invalid CSRF token',
+            $request->getMethod() . ' ' . $request->getPathInfo()
+        );
+    }
 }
 
 class_alias(SessionController::class, 'EzSystems\EzPlatformRest\Server\Controller\SessionController');