Put the CSRF token in configuration.

Hahaha that was really stupid. Each worker would make its own token and
none would like POSTs from eachother!