Session-free CSRF prevention

Hi Jonny,
This is a patch to remove session\cookie from CSRF prevention mechanism. This part is required to use nginx fast-cgi cache. 
Mike