CSRF module now accepts a pre-existing cookie value to avoid overwriting an existing token.