Rotate CSRF token on login