Revert "Use safer alphabet to build the CSRF secret."

This reverts commit cf65ff92026987182f6e18aeb300487b1f94696f.

This actually fixed nothing; I had misunderstood the problem.  We're
not sending the secret generated here as is, but just using them as
a key to encode what we actually send to the client.