Session controller should not require CSRF when creating session

Author: Steveb-p

src/lib/Server/Controller/SessionController.php

@@ -78,10 +78,6 @@ public function createSessionAction(Request $request)
 
         try {
             $session = $request->getSession();
-            if ($session->isStarted() && $this->hasStoredCsrfToken()) {
-                $this->checkCsrfToken($request);
-            }
-
             $token = $this->getAuthenticator()->authenticate($request);
             $csrfToken = $this->getCsrfToken();