Store CSRF token in cookie rather than session

This is much cheaper in case a server-side session store are used.