fixes #3609

Closes #3609

Merge request studip/studip!2500

lib/classes/CSRFProtection.php

@@ -69,7 +69,7 @@ class CSRFProtection
                 throw new SessionRequiredException();
             }
 
-            self::$storage = $_SESSION;
+            self::$storage =& $_SESSION;
         }
         return self::$storage;
     }