csrf: prevent salt generation on every request, and add async req.csrfToken(fn)
Release 2.8.7