csrf_token now returns 40 chars and uses openssl_random_pseudo_bytes if possible