csrf: refactor to use HMAC tokens