dont need to keep csrf in cookie
Merge pull request #108 from mozilla/kill-csrf

dont need to keep csrf in cookie