Lazy generation of the CSRF token

It's still a WIP.

Ref.: #7.