WIP Csrf plug

very rough
The :csrf_token key from the old_conn's session and the new_conn's session don't match. Is it right for me to expect that a session would persist across connections?