Fix csrf reuse

- This should allow us to get a new cookie reissued each time there is a login event.