Add support for CSRF Token refreshes

toggleable via the csrf_tokens helper in config