clarification of where the session id used as part of csrf token generation comes from