fix(ui): guard against nil session in CSRF middleware

The CSRF middleware assumes a session is always present in the request
context, but the web session middleware skips session creation for
static-asset routes (/js/*, /stylesheets/*, /icon/*, etc.).

A POST request to any static path causes a nil-pointer panic when
calling .CSRF() on the nil session.

Add a nil check to return 400 Bad Request when no session is present.