Move CSRF token handling into MediaWiki\Session\Session