Make sure csrf tokens match on client and server.

We should extract a method which gets the sessionId, and use it in both places.