Added an option to reuse the anti-CSRF key.

This will prevent invalidating keys if the same page is visited in a
different tab. It should still provide as good protection against CSRF
as the key will still unknown to anyone but the client. However, this
method must NOT be for GET requests as GET would expose the key. Fixes
#38.