Fixed csrf test that assumed an access token allows application access, which is actually api token. Improved return type hinting in the StartSession middleware