Move CSRF token into span#metadata

Also use 'data-' prefix on custom attributes