Remove async version of csrfToken() & use a fast non-blocking PRNG

As discussed in #881: Removed async version of csrfToken(). Used Math.random() as PRNG for the salt generation (which removes the need for async).