fix CSRF protection: per-session key

see https://github.com/leafo/lapis/issues/219
persistent cookies