Split into a two-value tuple in case for csrf attack.

Hackers can broke the server by sending csrf token like:

```
string##string##string
```

In this case, it will be a three-value tuple.