generate and send stateless CSRF token