CSRF protection should use cryptographic hashing + salt for protection from BREACH attacks

[fnimick]

See here: https://github.com/pillarjs/understanding-csrf/blob/master/README.md#breach-attack - using a static value for the csrf token for repeated requests is dangerous.