Session tracking framework and CSRF token skeleton