This would set up a single CSRF value in the app, for a million users. This defeats the whole purpose of CSRF.