centralized csrf token management; closes #132