[IMP] Only create CSRF token if necessary

This way we don't modify (and thus store) the session unless it actually
contains useful data (guests do not need a CSRF token!)
[IMP] Refresh sessions after some time

prevents users from being logged out unexpectedly