fix: preserve JSON request body when CSRF token is not in it

[gr8man]

Description

When the CSRF token was sent via the X-CSRF-TOKEN header and the request body was valid JSON that is not an object (e.g. a JSON array), removeTokenInRequest() fell through to the form-encoded branch and rewrote the body into a URL-encoded string ([{"foo":"bar"}] became empty, 123 became 123=). A valid JSON body that is not an object is now left untouched.

Checklist:

• Securely signed commits
• Component(s) with PHPDoc blocks, only if necessary or adds value (without duplication)
• Unit testing, with >80% coverage
• User guide updated
• Conforms to style guide