Fix #249: Never cache CSRFToken.

I'm surprised it doesn't use the word `public` in there. I always thought that was something you needed to set to avoid proxies from snatching it. Perhaps times have moved on since then.