some csrf token issues, now we generate the token per-session instead of per-request
Merge branch 'new-csrf' into develop