Added an option to reuse the anti-CSRF key.

This will prevent invalidating keys if the same page is visited in a different tab. It should still provide as good protection against CSRF, as the key will still unknown to anyone but the client. However, this method must NOT be for GET requests as GET would expose the key. Fixes #38.