Fix 403 errors after signup

Closes #2819

- Keep around the _csrfSecret on the session after regenerating
Merge pull request #2820 from jgable/fix403

Fix 403 errors after signup