Fix 403 errors after signup

Closes #2819

- Keep around the _csrfSecret on the session after regenerating

To figure this out I took a look at the connect csrf middleware and noticed that the `session._csrfSecret` was getting blown up after we regenerate on signup.  I tried to do a `req.csrfToken()` and send that down to the page after signup, then use the updated CSRF value but that didn't seem to work.

Why are we regenerating the session after signup?  Is this a security practice I'm not aware of?