removed old csrf code, added convenience function for resetting session csrf secret