* added hook for when we create a csrf token for the first time for this
session. This is useful for sending that token to a back-end for
verification
* csrf token is a bit more un-crackable