Primitive CSRF protection with seed (timestamp) and token

Token doesn't expire or get invalidated.