Csrf: randomize token for each response and clean up API & tests