Use CSRF token instead of session id as cache key.

Cookie-based sessions don't have an ID.