Removed async version of csrfToken(). Used a fast non-blocking PRNG for the salt generation (which removes the need for async).