Don't use session for csrf token

the csrf-lite module will use whatever value you pass into it as the csrf token. In this case the csrf token was the HTTPOnly / secure session token. It's best practice to not take this value and then expose it to javascript and instead used a randomly generated value. I'm pretty sure this change does what we want.