Add fallback logic for AntiForgeryToken, don't send a new AntiForgeryToken cookie on every request

[drayfar]

Adds logic to fall back to the built-in AntiForgeryToken hidden input if no FlushedAntiForgeryToken exists. Avoids sending a new AntiForgeryToken cookie in the response if one already exists in the request.