Add support for CSRF Token refreshes

Toggleable via the csrf_tokens helper in config, fixes #11