Rename CSRF cookie, header, HTML token