restore CSRF tokens closes getlantern/lantern#1098