Add a ctor to AuthenticityToken and change class methods to instance

Do all the session manipulation in the constructor, and just operate
on a copy of the CSRF token in the instance methods. Slightly
simplifies the controller mixin code and makes the API read a bit
better.