Fix #249: Never cache CSRFToken.