Allow for independent authenticity tokens per-scope

After authenticating, this resets the unauthenticated session's CSRF
token, and also resets it for the newly-authenticated scope. When
authenticating to a second scope, the CSRF token for the original
scope is not destroyed.