Fix suggested DSN in the config file (thanks to Laurent Papier).
Enforce validation of the CSRF token (if any) on new sessions too.

Only pre-set the token when authentication has been validated. This allows us
to detect forgery/fixation attempts.