CsrfTokenHolder is now Serializable, closes #1