Refactor CSRF, add cookie and session-based