fix(CSRF) Use a different message when CSRF token is unexpected

Attempt at easing CSRF protection problems debugging.

issue #6023

include/class_CSRFProtection.inc

 <?php
 /*
   This code is part of FusionDirectory (http://www.fusiondirectory.org/)
-  Copyright (C) 2017-2018 FusionDirectory
+  Copyright (C) 2017-2019 FusionDirectory
 
   This program is free software; you can redistribute it and/or modify
   it under the terms of the GNU General Public License as published by
@@ -31,6 +31,10 @@ class CSRFProtection
 
     static::checkHeaders();
 
+    if (!session::is_set('CSRFtoken')) {
+      throw new FusionDirectoryException('Unexpected CSRF protection token');
+    }
+
     if ($_POST['CSRFtoken'] !== static::getToken()) {
       throw new FusionDirectoryException('CSRF protection token invalid');
     }