again, this isn't our csrf-secret, it's the result of encrypting the userid with our secret, so maybe it's not actually a big deal at all