Create only one CSRF token per session

Backport of #178 to stable45, because of #1006.

\cc @karlitschek, @DeepDiver1975, @tanghus, @arkascha