stop generating masked csrf tokens for now

@tamird @gglider