Change logic on CSRF token generate.

Currently logic of generate token can be inferred.
because, uniqid() uses microtime.

I tried use more secure logic that used salt.