CSRF prevention through transient key validation

This also adds the `temporary` access tokens like we discussed.